Data processing agreement.

01Parties and roles

This agreement is between the client (the controller) and Jan Gimenez Layola, trading as Birrejan, Koraaldijk 22, 4706 KA Roosendaal (NL), Chamber of Commerce (KvK) 42206299 (the processor). It is part of the assignment and of the terms and conditions. On data protection, this agreement takes precedence over the terms.

Words such as personal data, processing, controller, processor, sub-processor and personal data breach have the meaning they have in the General Data Protection Regulation (GDPR).

02What is processed

Before processing starts, the parties document a project-specific annex in the quote or another written agreement. It must identify the subject matter, duration, nature and purpose, types of personal data, categories of people, documented instructions, processing locations, approved sub-processors, transfers and applicable safeguards, security measures, and arrangements for return or deletion. The parties update it when the processing changes. Special-category data is processed only when explicitly agreed with appropriate safeguards.

03Only on your instructions

I process the personal data only on the client's documented instructions, which are the assignment and what the client asks in writing, unless the law requires otherwise. I don't use it for my own purposes. If I think an instruction breaks the GDPR, I'll tell the client straight away.

04Confidentiality and security

I keep the personal data confidential. Anyone I involve with the client's permission is bound to the same confidentiality.

I take appropriate technical and organisational measures to protect the data, at least the following:

• I work in the client's own accounts and infrastructure wherever possible, and keep as few copies of personal data as I can.
• I use anonymised or made-up test data instead of real personal data where the work allows it.
• My accounts use strong, unique passwords and two-factor authentication; my laptop has full-disk encryption.
• Data is sent only over encrypted connections, and access is limited to what the assignment needs.
• Personal data doesn't go into AI tools without the client's permission (section 05).

05Sub-processors and AI tools

• The client gives general permission for the sub-processors listed in the quote or agreed in writing, such as the hosting provider or the AI model provider of the system being built. Services the client contracts directly, on its own accounts, are the client's own processors.
• Before adding or replacing a sub-processor I inform the client at least 14 days ahead. The client may object on reasonable grounds; if we can't solve it, the client may end the affected part of the assignment.
• I impose the same data protection obligations on every sub-processor, and remain responsible to the client for them.
• Personal data of the client only goes into AI tools I use for development if the client has agreed to it in writing, subject to the agreed contractual and technical safeguards.

06Outside the European Economic Area

Personal data is only transferred outside the EEA, or accessed from outside it, if the client has agreed to it and the GDPR's conditions for such transfers are met, for example an adequacy decision or standard contractual clauses.

07Help with rights and obligations

I help the client, as far as reasonable, to respond to people exercising their rights (access, correction, deletion and so on) and with security, data protection impact assessments and prior consultation with a supervisory authority. Requests I receive directly from people concerned are forwarded to the client. Help that goes beyond a small effort can be charged at my normal rate.

08Personal data breaches

If I discover a personal data breach involving the client's data, I inform the client without undue delay, and within 48 hours at the latest. I share what I know about the nature of the breach, the data and people affected, the likely consequences and the measures taken, and keep the client updated. Notifying the supervisory authority and the people concerned is up to the client.

09When the assignment ends

At the end of the assignment, the client chooses whether I delete the personal data or return it. I do so within 30 days and delete any remaining copies, unless the law requires me to keep them. On request I confirm in writing that this has been done.

10Information and audits

I provide the information needed to demonstrate compliance and allow and contribute to audits, including inspections, by the client or an auditor appointed by the client. Ordinary audits are arranged with reasonable notice and confidentiality safeguards. Additional or urgent audits may be necessary after an incident, suspected non-compliance or a regulatory request. Timing, scope and reasonable costs are agreed without restricting mandatory rights.

11Liability and duration

Liability under this agreement follows the limits in the terms and conditions, as far as the law allows. This agreement lasts as long as I process personal data for the client, and the obligations that by their nature continue (such as confidentiality) keep applying afterwards. Dutch law applies, and disputes go to the court named in the terms.