Processor agreement

This processor’s agreement applies to all forms of processing of personal data carried out by WP Provider BV., hereinafter referred to as “WP Provider”, having its registered office in Bussum, the Netherlands, and registered with the Chamber of Commerce under number 73142689, (hereinafter referred to as “Processor”) on behalf of a contracting party to whom it provides services (hereinafter referred to as “Controller”).

Hereinafter jointly referred to as ‘Parties’;

Considering:

1. The parties have entered into an agreement relating to hosting services and domain name registrations, hereinafter referred to as the “Agreement”. In order to execute the Agreement, Processor processes Personal Data on behalf of Processor;
   Parties wish to carefully handle the Personal Data that are (to be) processed for the execution of the Agreement, in accordance with the AVG and other Applicable Laws and Regulations regarding the Processing of Personal Data;
   C. In accordance with the AVG and other Applicable Laws and Regulations regarding the Processing of Personal Data, the Parties wish to lay down their rights and obligations regarding the Processing of Personal Data of Data Subjects in writing in this Processing Agreement.
   D. Solely Processor determines the purpose of and means for processing personal data and Processor has no influence over it;

Have agreed as follows:

1. Concepts

1.1 Data Subject: the person to whom a Personal Data relates.
1.2 Data leak: a breach of the security of Personal Data which has serious adverse consequences for the protection of Personal Data.
1.3 Staff: the persons to be engaged by the Parties for the performance of this Processing Agreement, who will work under their responsibility.
1.4 Personal data: any data concerning an identified or identifiable natural person. Also (traceable) pseudonymised personal data are covered by this concept.
1.5 Subprocessor: third party engaged by Processor to process Personal Data on behalf of Processor, without being subject to the direct authority of Processor.
1.6 Controller: the party responsible for Processing within the meaning of the Dutch Personal Data Protection Act (WBP) and/or European regulations and directives relating to the protection of personal data (AVG).
1.7 Processor: the person who processes Personal Data on behalf of the Controller without being subject to its direct authority.
1.8 Processing: any action or set of actions with regard to Personal Data, including in any case the collection, recording, organisation, storage, adaptation, alteration, retrieval, consultation, use, provision by means of transmission, dissemination or any other form of making available, bringing together, linking, as well as the blocking, erasure or destruction of data.

2. Topic

2.1 If Processor only has access to the Personal Data, without an obligation to process it, Processor will comply with both the national and international laws and regulations relating to personal data and the provisions of this Processor Agreement; if and insofar as Processor has informed Processor in a timely manner in advance of the presence of Personal Data and the place (path) where this Personal Data is located.
2.2 If Processor has undertaken to process Personal Data in the Agreement, Processor will do so with great care and in accordance with the purposes of the processing and in so doing will comply with both the national and international laws and regulations relating to personal data and the provisions of this Processor Agreement; if and insofar as Processor has informed Processor in a timely manner in advance of the presence of Personal Data and the location of this Personal Data.

3. Obligations of the Controller

3.1 The Processing Party will notify the Processor of any changes relating to the Processing (if applicable) and any consequences thereof in a timely manner, in principle within 10 working days.
3.2 Controller warrants that the order to Process the Personal Data (if any) is not unlawful and does not infringe any third party rights.

4. Obligations of the Processor

4.1 The Processor will only access and/or process the Personal Data if and to the extent that this is necessary for the performance of the Agreement and will comply with all reasonable instructions given by the Processing Responsible Party.
4.2 Processor will not store the Personal Data at a location outside the European Economic Area. For domain registrations it may be necessary to transfer personal data to countries outside the European Economic Area. This is then limited to what is required by the registry in question.
4.3 The Processor guarantees that its Personnel will comply with the provisions of this Processor Agreement if and insofar as they are involved in any way in the Processing of Personal Data. The employees of the Processor are bound by a duty of confidentiality.
4.4 The Processor has appointed a Data Protection Officer.
4.5 Upon Processor’s first request, Processor will immediately provide Processor with all copies of Personal Data originating from and/or processed on the instructions of Processor or, if requested, destroy them.
4.6 Verwerker zal passende technische en organisatorische beveiligingsmaatregelen treffen om de Persoonsgegevens te beveiligen tegen verlies en tegen onrechtmatige verwerking. 4.6 Processor will take appropriate technical and organizational security measures to secure the Personal Data against loss and against unlawful processing.
4.7 The Processor will keep a register of all categories of processing activities that it has carried out on behalf of the Processor.
4.8 The Processor will provide the Complainant with its full and timely cooperation in order to allow the Complainant to inspect its personal data, have its personal data removed or corrected, and/or demonstrate that this personal data has been removed or corrected or, if the Processor disputes the Complainant’s view, to record that the Complainant considers its personal data to be incorrect.
4.9 Processor shall adopt adequate internal control measures to comply with the obligations of this Agreement and shall record them in a manner that allows for easy verification of compliance. When Processing Personal Data, activities and incidents relating to the Personal Data are recorded in log files.
4.10 At the request of the Controller, the Processor will cooperate in encrypting and pseudonymising Personal Data. If this results in higher costs for Processor, Processor will reimburse Processor for these costs.
4.11 Once a year, the Processing Entity may have the Processing of Personal Data checked for correct compliance with the Processing Agreement by means of an examination by an independent registered EDP auditor. The Auditor will be required to maintain confidentiality. Processor shall provide all information requested by the Auditor. The Auditor will report to Controller in general terms, but will not disclose details of the security measures in place. The costs of the investigation will be borne by the Processing Agent.
4.12 The content and scope of the assignment to Process and the fee to be paid for it are in accordance with what is provided for in the Agreement. Processor will comply with instructions from Processor regarding the processing and/or storage of Personal Data.

5. Subprocessor

5.1 Processor may subcontract the performance of the Processing Agreement, in whole or in part, to a Subprocessor. The Processor will remain the point of contact for the Processing Responsible Party at all times and will be responsible for compliance with the provisions of this Processor Agreement.
5.2 The Processor shall impose the same obligations on the Subprocessor – and record them in a contract – as they arise from this Processor Agreement and shall ensure that the Subprocessor complies with them. Processor is fully liable to Processor for the consequences of outsourcing work to a Subprocessor.
5.3 An exception to Articles 5.1 and 5.2 is the outsourcing of domain name registrations. Depending on the Top Level Domain, your personal data may be made public and/or the processor cannot guarantee the security of your personal data.

6. Provision of Personal Data

6.1 The Processor is not permitted to provide Personal Data to anyone other than the Processor, except pursuant to a legal obligation or for the purposes of the agreement with the Processor.
6.2 If Processor is required to provide Personal Data under a legal obligation, Processor shall:

• verify the basis of the request and the identity of the requester and, prior to the provision, inform the Processing Agent accordingly;
• limit the provision to what is required by law;
• Enable Processor to exercise the rights of Processor and Data Subjects and defend the interests of Processor and Data Subjects;
• when providing data to a Data Subject, provide the data in a structured, commonly used and machine-readable form.

7. Security

7.1 The Controller and the Processor will take appropriate technical and organisational measures to ensure a risk-appropriate security level, so that the Processing will meet the requirements of the AVG and other Applicable Laws and Regulations regarding the Processing of Personal Data and the protection of the rights of Data Subjects is guaranteed. The security measures that Processor takes are included in Appendix A.
7.2 The Processing Agent and the Processor will make every effort to protect the Personal Data and to keep them protected against intrusions and external calamities, as well as against careless processing, unlawful provision or unauthorised provision and against loss, destruction or damage. Both Parties shall ensure that their IT facilities and equipment are physically protected against unauthorised access, damage and disruption and shall take measures to prevent unauthorised access to information systems.
7.3 The Controller and the Processor will continually monitor whether the processing systems used (continue to) meet adequate requirements of confidentiality, integrity, availability and resilience (rapid recovery after temporary unavailability).
7.4 If requested in writing by the Processing Party, the Processor will take special measures for the security and/or confidentiality of the Personal Data or categories of Personal Data specified in the request. If this results in higher costs for Processor, Processor will reimburse Processor for these costs.

8. Data breach

8.1 If a Data Leak occurs at the Processor, the Processor will report this immediately, but in any event within 24 hours, to the Processing Responsible Party, stating the nature of the Data Leak, the consequences (or suspected consequences) and the measures that have been taken to remedy or limit the consequences.

9. Confidentiality

9.1 All data of Processor and its customers are confidential and will be treated as such by Processor. Processor is required to maintain confidentiality of all Personal Data and information that it processes, or becomes aware of in the context of the Agreement or this Processing Agreement.
9.2 Confidentiality does not apply to information:

• Which is publicly known without such disclosure being a result of an unlawful act;
• Whose disclosure is required by any legal provision or court order, all subject to prior written notification by the disclosing party to the party whose information is affected;
• Who developed a Party independent;
• Which a Party already possesses without an obligation of confidentiality.
• After the termination of this Processor Agreement, this Article and the obligation of confidentiality stipulated herein shall remain in force.

10. Intellectual Property

10.1 All Intellectual Property Rights, including copyrights, database rights and all other rights of intellectual property and similar rights to protect information on the collection of data and Personal Data, copies or adaptations thereof, are vested in the Controller (or a customer of the Controller).
10.2 All intellectual property rights – including copyrights, database rights and all other intellectual property rights and similar rights to protect information – on the products and services of the Processor, belong to the Processor.

11. Liability and Insurance

11.1 The Processor is liable for any damage suffered by the Processing Party and any penalties forfeited by the Processing Party as a result of the Processor’s failure to comply with, or its failure to comply with, regulations under or pursuant to the Personal Data Protection Act and/or European regulations and directives relating to the protection of personal data and/or other relevant laws and regulations and/or this Processor Agreement.
11.2 The liability of the Processor for damage suffered by the Processing Party and/or penalties forfeited as referred to in Article 11.1 is limited to € 50 per event. This limitation of liability will lapse if and insofar as the damage is the result of intent or gross negligence (deliberate recklessness) on the part of Processor.
11.3 The Processing Responsible Party will indemnify the Processor against claims from third parties (in particular Data Subjects) and any damage resulting therefrom, based on non-compliance with provisions under or pursuant to the Personal Data Protection Act and/or European regulations and directives regarding the protection of personal data and/or other relevant laws and regulations and/or this Processor Agreement.
11.4 The Processor undertakes to cover the risks referred to in Articles 11.1 to 11.2 by means of liability insurance.

12. Duration and termination

12.1 The Processing Agreement will enter into force on the day it is signed by the Parties.
12.2 The provisions regarding duration and termination of the Agreement will apply as provisions regarding duration and termination of the Processing Agreement. If the Agreement ends for any reason, the Processing Agreement also ends.
12.3 In the event of termination of the Processing Agreement, Processor will transfer all Personal Data to Processor, or, upon the express written request of Processor, destroy the Personal Data in Processor’s possession.
12.4 Obligations which by their nature are intended to continue after termination of the Processing Agreement will continue after termination. These obligations include provisions on confidentiality, transfer and destruction, liability and applicable law.

13. Dissolution

13.1 Each Party may dissolve the Agreement, either wholly or in part, if the other Party fails imputably to perform the Processing Agreement and the failure has not been remedied even after notice of default has been given, without prejudice to the right to compensation.
13.2 Each Party may dissolve the Agreement in whole or in part with immediate effect without notice of default if the other Party is granted a suspension of payments, if a petition for bankruptcy is filed with regard to the other Party, if the other Party’s business is wound up or terminated other than for the purpose of reconstruction or merger of companies.

14. Other

14.1 Amendments or supplements to this Agreement will be agreed in writing between the Processor and the Processing Party. Amendments or supplements shall be set forth in an addendum to this Agreement and shall be binding when signed by both Parties.
14.2 Any disputes arising from this agreement shall, after an attempt to resolve the dispute by mutual consultation has proved fruitless, be settled by arbitration in accordance with the rules and procedures of the Netherlands Arbitration Institute, whereby the arbitrator(s) shall apply Dutch law.

Annex A – Security measures

The measures with which Processor complies as a minimum:

1. The Processor has a policy document that explicitly addresses the measures that the Processor takes to secure the processing of the data, as well as to ensure privacy.
2. The employees of the Processor who are involved in the processing of personal data are bound by a duty of confidentiality/code of integrity and, if applicable, a screening has taken place prior to commencement of employment.
3. All employees of the organization and, as applicable, contracted personnel and external users receive appropriate training and regular refresher training on the organization’s information security policies and procedures relevant to their job functions. The training and refresher courses pay explicit attention to the handling of personal data.
4. IT facilities and equipment are physically protected against unauthorized access and against damage and malfunctions.
5. Procedures are in place to give authorised users access to the information systems and services they need to carry out their duties and to prevent unauthorised access to information systems.
6. Adequate encryption must always be used when transporting confidential information over networks that is explicitly designated as such by the Processing Manager.
7. For the management of certificates and the associated keys, a current key plan is applicable in which authorisations and segregation of duties are guaranteed.
8. There are procedures for the acquisition, development, maintenance and destruction of data and information systems.
9. Activities that users perform (with personal data) are recorded in log files. The same applies to other relevant events, such as attempts to gain unauthorized access to personal data and disruptions that could lead to mutilation or loss of personal data. Logging of specific data is possible on the basis of a custom quote.
10. Security measures are built into all application systems including adequate access management.
11. The network and information systems are actively monitored and managed. There is also a procedure available to deal with any data breaches. Part of this is informing the Processing Manager.
12. The Processor shall install in a timely manner solutions released by suppliers for security vulnerabilities. All this will only take place if and insofar as the software concerned is supplied, used or maintained by the Processor for the benefit of the Processing Responsible Party.
13. Procedures are in place to deal with information security incidents and security weaknesses in a timely and effective manner, once they are reported.
14. The Processing Responsible Party will report data breaches that are subject to a statutory reporting obligation to the relevant supervisory authority (usually the Dutch Data Protection Authority [Autoriteit Persoonsgegevens]).