Translation. In case of discrepancy, the Dutch text prevails.
This data processing agreement implements Article 28 of Regulation (EU) 2016/679 (“the GDPR”). It forms part of every Agreement between Cashplannr BV, Zeitje 5, 9681 Maarkedal, CBE 0741.779.289 (“the Processor”), and the customer that signs the Order Form (“the Controller”). Capitalised terms have the meaning given in Cashplannr’s general terms and conditions.
1.1. This agreement applies as soon as the Controller signs an Order Form that refers to it. That signature, including electronically, constitutes written acceptance within the meaning of Article 28(9) GDPR.
1.2. The Processor processes personal data on behalf of the Controller in the provision of the Platform and the Implementation. If the Controller also contracts for Affiliated Companies, it acts on their behalf and is responsible for their instructions.
1.3. The nature and purpose of the processing, the categories of data subjects and of personal data, and the duration are set out in Annex A. The Order Form may supplement that description for the specific activity of the Controller.
1.4. This agreement applies for as long as the Agreement is in force and for as long as the Processor processes personal data for the Controller.
2.1. The Processor processes the personal data solely on documented instructions from the Controller. The Agreement, the settings that the Controller selects in the Platform and the use of the Platform by its Users constitute such instructions.
2.2. If the Processor is legally required to carry out processing outside those instructions, it informs the Controller in advance, unless that law prohibits this on important grounds of public interest.
2.3. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection rules.
2.4. The Processor does not process the personal data for its own purposes and does not use it to train language models. Fully anonymised and aggregated data, from which no data subject or customer is identifiable, is not personal data; the Processor may use it as provided in Article 9.3 of the general terms and conditions.
3.1. The Processor ensures that persons under its authority who have access to the personal data are bound by confidentiality and are given access only to the extent required by their task.
4.1. The Processor takes appropriate technical and organisational measures as referred to in Article 32 GDPR. Annex B describes the measures as at the date of this version.
4.2. The Processor may adapt the measures to the state of the art, provided that the level of security does not decrease.
4.3. The Controller is responsible for managing the accounts of its Users, for the choice of strong passwords and for activating two-factor authentication where it is available.
5.1. The Controller gives general authorisation to engage sub-processors. Annex C contains the sub-processors as at the date of this version. The Processor keeps the current list up to date and provides it on request.
5.2. The Processor gives notice of the addition or replacement of a sub-processor at least thirty days in advance. Within that period, the Controller may object, stating reasons, on data protection grounds. The Parties then seek a solution in good faith. The Processor may, among other things, propose to disable the relevant feature for the Controller or to use an alternative. If there is no solution after thirty days, the Controller may terminate the Agreement for the part that cannot be provided without that sub-processor, without compensation and with a pro rata refund of the fee paid in advance for that part.
5.3. The Processor imposes on each sub-processor, by contract, data protection obligations that are essentially equivalent to those of this agreement, as required by Article 28(4) GDPR. It remains liable to the Controller for the performance by the sub-processor as for its own acts, within the limits of Article 12.
6.1. The database and the backups of the Platform are hosted within the European Economic Area (EEA).
6.2. Personal data is transferred outside the EEA, or accessed from outside the EEA, only by the sub-processors in Annex C, on the basis of an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or of the standard contractual clauses of the European Commission, supplemented by appropriate measures where necessary.
6.3. For AI Features, the Processor transmits only the data necessary for the task concerned. Names of counterparties, account numbers, email addresses and telephone numbers are pseudonymised beforehand: they are replaced by neutral labels. For as long as this is not possible for an AI Feature, that feature is disabled and is only activated at the express written request of the Controller.
6.4. For language models, the Processor uses the suppliers’ business services, under which submitted data is not used to train models. On request, it provides a description of the measures applied. At the Controller’s request, it disables the AI Features.
7.1. Taking into account the nature of the processing, the Processor provides reasonable assistance with requests from data subjects under Articles 15 to 22 GDPR.
7.2. If the Processor receives such a request directly, it does not respond to it itself but forwards it to the Controller without delay.
7.3. Assistance that requires significant effort and does not result from a failure by the Processor may be charged at the day rate of the Order Form, after a prior estimate.
8.1. The Processor notifies the Controller of any personal data breach without undue delay, and in any event within forty-eight hours of becoming aware of it.
8.2. The notification contains, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact person. Missing information is provided in phases.
8.3. The Controller decides on notification to the supervisory authority and to the data subjects. The Processor provides reasonable assistance in this regard.
9.1. Taking into account the nature of the processing and the information available to it, the Processor provides reasonable assistance with a data protection impact assessment and with a prior consultation of the supervisory authority. Article 7.3 applies mutatis mutandis.
10.1. The Processor makes available the information necessary to demonstrate compliance with Article 28 GDPR, primarily through documentation, descriptions of measures and written answers to questions.
10.2. If that information is reasonably insufficient, the Controller may have an audit carried out no more than once per calendar year. It gives thirty days’ notice of this. The audit takes place during office hours, without unreasonably disrupting the Processor’s operations and without access to data of other customers. Following a personal data breach, an additional audit may take place.
10.3. The auditor is not a competitor of the Processor and is bound by confidentiality. The Controller bears the costs, including the Processor’s time at the day rate, unless the audit demonstrates a material failure by the Processor.
11.1. After the end of the Agreement, the Controller may request an export of the data in a commonly used structured format for a period of thirty days.
11.2. After that period, the Processor deletes the personal data from the production environment within ninety days. Data in backups is deleted in accordance with the backup rotation in Annex B and, until then, is no longer accessible for ordinary use.
11.3. The Processor may retain personal data for longer to the extent that a statutory retention obligation requires this, and solely for that purpose.
12.1. Liability under this agreement is subject to the limitations of Article 15 of the general terms and conditions. Those limitations apply to all claims under this agreement and the rest of the Agreement together. They are without prejudice to the mandatory rights of data subjects under Article 82 GDPR.
12.2. In the event of conflict, this agreement takes precedence over the general terms and conditions as regards the processing of personal data, except for liability, for which Article 12.1 applies.
12.3. This agreement is governed by Belgian law. The courts that have jurisdiction under the general terms and conditions also have jurisdiction over disputes concerning this agreement.
Nature and purpose. Hosting and making available a platform for cash planning, budgeting and financial reporting per company, per project and for a group. This includes importing data from Third-Party Systems of the Controller, managing user accounts, the Implementation, support, AI Features in accordance with Article 6.3, backups, security and recovery.
Categories of data subjects.
Categories of personal data.
Special categories. No special categories of personal data within the meaning of Article 9 GDPR and no data relating to criminal convictions are processed. The Controller does not enter such data into the Platform.
Duration. The duration of the Agreement, followed by the export and deletion periods of Article 11.
As at the date of this version.
| Area | Measure |
|---|---|
| Hosting | The production environment runs at DigitalOcean in the Frankfurt data centre (Germany), within the EEA. The database runs on a separate server of the Processor in the same data centre, accessible only from the private network of the Platform and protected by a firewall. Connections to the database are encrypted via TLS, with verification of the server certificate. |
| Transport | All connections to the Platform are encrypted using TLS. Integrations with Third-Party Systems run over encrypted connections and via authorisation in those systems; the Processor does not store any passwords of the Controller for those systems. |
| Access to the infrastructure | Restricted to the administrators designated by the Processor, currently the managing director, exclusively via SSH keys; password authentication is disabled. |
| Access within the Platform | Roles for administrator, user and partner. A User sees only the companies for which they have rights. Two-factor authentication is available. |
| Support access | Employees and subcontractors of the Processor are given access to customer environments only to the extent required by their task and are contractually bound by confidentiality. |
| Passwords | Passwords of Users are stored in hashed form. |
| Backup and recovery | Daily automatic backups of the database, stored outside the database server and within the EEA, with tiered retention: all backups for seven days, then one per day up to sixteen days, one per week up to eight weeks, one per month up to four months and one per year up to two years. In addition, DigitalOcean takes a weekly copy of the entire database server, and point-in-time recovery within the last seven days is possible. Recovery is tested periodically. |
| Logging | Logins and relevant actions in the Platform are logged and retained for 180 days. |
| Data segregation | The data of each customer is logically segregated per environment. |
| Language models | Only the data necessary for a specific task is sent to the language model, after pseudonymisation in accordance with Article 6.3. Business APIs of the suppliers, without training on submitted data. |
| Vulnerabilities | Operating system security updates are applied automatically. Critical updates of application dependencies are applied as soon as possible after publication, others regularly. A first external penetration test is in preparation. |
| Incidents | Security incidents are recorded, assessed for impact and handled in accordance with Article 8. |
As at the date of this version. Changes are communicated in accordance with Article 5.2.
| Sub-processor | Service | Data location | Transfer mechanism |
|---|---|---|---|
| DigitalOcean LLC | Hosting of the application, database and backups | Frankfurt, Germany (EEA) | Standard contractual clauses or EU-US Data Privacy Framework, for any access from the US |
| OpenAI Ireland Ltd. / OpenAI, L.L.C. | Language models for suggestions, categorisation and the assistant | EU and US | Standard contractual clauses or EU-US Data Privacy Framework; data pseudonymised beforehand |
| Anthropic Ireland, Limited / Anthropic PBC | Language models for suggestions, categorisation and the assistant | EU and US | Standard contractual clauses or EU-US Data Privacy Framework; data pseudonymised beforehand |
| Mailgun Technologies Inc. | Sending of system and support messages | EU | Standard contractual clauses, for any access from the US |
| Functional Software Inc. (Sentry) | Error monitoring | EU | Standard contractual clauses, for any access from the US |