Appendix 1:
Data Processing Agreement
Read the Data Processing Agreement of Cremers Computer Company here
Data Processing Addendum (Appendix General Terms and Conditions)
This Data Processing Agreement is an annex to “the General Terms and Conditions for the Provision of Hosting/ICT Services of Cremers Computer Company, available at: https://www.cremerscomputers.nl/algemene-voorwaarden/” (hereinafter: the Main Agreement) between the Customer (hereinafter: Controller) and Cremers Computer Company (hereinafter: Processor).
Cremers Computer Company will process Personal Data on behalf of its customers during or in connection with the provision of its Services. Pursuant to Privacy Legislation, the Customer is designated in this capacity as the Controller of the Processing of Personal Data and Cremers Computer Company as the Processor. This Addendum contains the terms and conditions of this Processing of Personal Data by Cremers Computer Company.
Article 1. Purposes of processing
1.1. The Processor undertakes, under the terms of this Data Processing Agreement, to process personal data on behalf of the Data Controller. Processing shall take place exclusively within the framework of the Main Agreement, specifically for the purpose of storing the Data Controller's data in the ‘cloud’ and associated online services, hosting of websites and servers, plus those purposes reasonably connected therewith or determined by further consent.
1.2. The personal data processed by the Processor in the context of the activities referred to in the previous paragraph and the categories of data subjects from whom they originate are listed in Appendix 1. The Processor shall not process the personal data for any purpose other than as determined by the Controller. The Controller shall inform the Processor of the processing purposes insofar as these are not already mentioned in this Data Processing Agreement.
1.3. The personal data to be processed on behalf of the Controller remain the property of the Controller and/or the relevant data subjects.
Article 2. Obligations of the Processor
2.1. With regard to the processing operations referred to in Article 1, the Processor shall ensure compliance with applicable laws and regulations, including in any event laws and regulations regarding the protection of personal data, such as the Personal Data Protection Act.
2.2. The Processor shall inform the Controller, at the latter's first request to that effect, of the measures taken by the Processor regarding its obligations under this Data Processing Agreement.
2.3. The obligations of the Processor arising from this Processor Agreement also apply to those who process personal data under the authority of the Processor, including but not limited to employees, in the broadest sense of the word.
2.4. The Processor shall immediately notify the Controller if, in its opinion, an instruction from the Controller is contrary to the legislation referred to in paragraph 1.
2.5. The Processor shall, to the extent within its power, provide assistance to the Controller for the purpose of conducting data protection impact assessments (PIAs).
Article 3. Transfer of personal data
3.1. Cremers Computer Company will only transfer Personal Data to a country outside the European Economic Area if that country guarantees an adequate level of protection and complies with the other obligations incumbent upon it under this Addendum and Privacy Legislation.
3.2. If the Customer transfers personal data to countries outside the European Union by means of the services, the Customer shall indemnify Cremers Computer Company against all legal claims by third parties based on the assertion that such personal data is transferred in violation of the provisions of the GDPR.
Article 4. Division of responsibility
4.1. The permitted processing operations are carried out in a fully automated manner under the control of the Processor.
4.2. The Processor is solely responsible for the processing of personal data under this Data Processing Agreement, in accordance with the instructions of the Controller and under the express (ultimate) responsibility of the Controller. The Processor is expressly not responsible for any other processing of personal data, including, but not limited to, the collection of personal data by the Controller, processing for purposes not notified by the Controller to the Processor, processing by third parties and/or for other purposes.
4.3. The Controller guarantees that the content, use, and instruction for the processing of the personal data as referred to in this Data Processing Agreement are not unlawful and do not infringe upon any rights of third parties.
Article 5. Engaging third parties or subcontractors
5.1. The Processor may use third parties within the framework of this Processor Agreement provided that such use is notified to the Controller in advance; the Controller may object if the use of a specific notified third party is unacceptable to it.
5.2. The Processor shall in any event ensure that these third parties assume in writing at least the same obligations as have been agreed between the Controller and the Processor.
5.3. The Processor guarantees the proper compliance with the obligations under this Data Processing Agreement by these third parties and, in the event of errors by these third parties, is itself liable for all damages as if it had committed the error(s) itself.
Article 6. Security
6.1. The Processor shall endeavor to take sufficient technical and organizational measures with regard to the processing of personal data to be performed, against loss or against any form of unlawful processing (such as unauthorized access, alteration, modification, or disclosure of the personal data).
6.2. The Processor does not guarantee that the security will be effective under all circumstances. If an expressly described security measure is missing from the Processing Agreement, the Processor shall endeavor to ensure that the security meets a level that is not unreasonable, having regard to the state of the art, the sensitivity of the personal data, and the costs associated with implementing the security.
6.3. The Controller shall only make personal data available to the Processor for processing if it has ensured that the required security measures have been taken. The Controller is responsible for compliance with the measures agreed upon by the Parties.
Article 7. Reporting obligation
7.1. The Controller is at all times responsible for reporting a security breach and/or data breach (which means: a breach of the security of personal data that results in a risk of adverse consequences, or has adverse consequences, for the protection of personal data) to the supervisory authority and/or data subjects. In order to enable the Controller to comply with this legal obligation, the Processor shall notify the Controller of the security breach and/or data breach within 48 hours after the breach has become known to it.
7.2. A report must always be made, but only if the event has actually occurred.
7.3. The reporting obligation entails, in any case, reporting the fact that a leak has occurred. In addition, the reporting obligation entails:
• the nature of the personal data breach, where possible indicating the categories of data subjects and personal data records concerned and, approximately, the number of data subjects and personal data records concerned;
• the name and contact details of the Data Protection Officer or another contact point where more information can be obtained;
• the likely consequences of the personal data breach;
• the measures proposed or taken by the Processor to address the personal data breach, including, where applicable, measures to mitigate any adverse effects thereof.
7.4. Cremers Computer Company shall provide further information regarding the Data Breach at the Customer's request, to the extent necessary for the Customer to comply with its legal obligations regarding notification to the Dutch Data Protection Authority and Data Subjects.
7.5. The Customer is obliged to actively assist Cremers Computer Company in the event of a Data Breach and the resulting reporting obligation for Cremers Computer Company to the Dutch Data Protection Authority pursuant to the Telecommunications Act.
Article 8. Handling requests from data subjects
8.1. In the event that a data subject addresses a request to exercise his/her legal rights to the Processor, the Processor shall forward the request to the Controller, and the Controller shall handle the request further. The Processor may notify the data subject thereof.
8.2. In the event of a request for access, rectification, deletion, or restriction of processing, Cremers Computer Company shall cooperate by providing, as soon as possible but no later than ten working days after the Customer requests Cremers Computer Company to do so, all information that the Customer needs to comply with the request or to proceed with the rectification, deletion, or blocking of the Personal Data indicated by the Customer, insofar as the Customer does not have independent access to these data through the services provided by Cremers Computer Company. The processor shall charge no more than reasonable costs for this (max. € 100 per hour for direct hours only).
Article 9. Secrecy and confidentiality
9.1. All personal data that the Processor receives from the Controller and/or collects itself within the framework of this Data Processing Agreement is subject to a duty of confidentiality towards third parties. The Processor shall not use this information for any purpose other than that for which it was obtained, even if it has been transformed into a form such that it cannot be traced back to the data subjects.
9.2. This duty of confidentiality does not apply to the extent that the Controller has given express permission to provide the information to third parties, if providing the information to third parties is logically necessary given the nature of the assignment provided and the execution of this Data Processing Agreement, or if there is a legal obligation to provide the information to a third party.
Article 10. Audit
10.1. The Controller has the right to have audits performed by an independent third party bound by confidentiality to verify the misuse of personal data by employees of the Processor, compliance with all points of the Data Processing Agreement, and everything directly related thereto.
10.2. This audit may take place in the event of a concrete suspicion of misuse of personal data.
10.3. The Processor shall cooperate with the audit and make all information reasonably relevant to the audit, including supporting data such as system logs, and employees available as timely as possible.
10.4. The findings resulting from the conducted audit will be implemented by the Processor as soon as possible.
10.5. The costs of the audit shall be borne by the Controller. The Processor shall not charge more than reasonable costs for this (max. € 100 per hour for direct hours only).
Article 11. Liability
11.1. The liability of the Parties for damage resulting from an attributable failure to perform the Data Processing Agreement, or from tort or otherwise, is limited per event (a series of consecutive events counts as one event) to compensation for direct damage, up to a maximum of the amount of fees received by the other Party for the work performed under this Data Processing Agreement during the month preceding the damage-causing event. The total liability of the Parties for direct damage shall never exceed € 3,000.00.
11.2. Direct damage shall exclusively mean all damage consisting of:
• damage caused directly to tangible property (“property damage”);
• reasonable and demonstrable costs to urge the party concerned to properly comply with the Data Processing Agreement (again);
• reasonable costs for determining the cause and extent of the damage insofar as it relates to the direct damage as referred to herein; and
• reasonable and demonstrable costs incurred by the Controller to prevent or limit the direct damage referred to in this article.
11.3. The Parties' liability for indirect damage is excluded. Indirect damage means all damage that is not direct damage and thereby includes, but is not limited to, consequential damage, lost profits, lost savings, diminished goodwill, damage due to business interruption, damage due to the failure to determine marketing objectives, damage related to the use of data or data files prescribed by the Controller, or loss, mutilation, or destruction of data or data files.
11.4. The exclusions and limitations referred to in this article shall cease to apply if and to the extent that the damage is the result of intent or willful recklessness on the part of the Party concerned or its management.
11.5. Unless performance by the relevant Party is permanently impossible, the liability of that Party for attributable failure to perform the Agreement shall arise only if the one Party gives the other Party written notice of default without delay, setting a reasonable period for remedying the default, and the other Party continues to be in attributable default in the performance of its obligations even after such period. The notice of default shall contain as complete and detailed a description of the default as possible, so that the relevant Party is given the opportunity to respond adequately.
11.6. Any claim for damages by one Party against the other Party that has not been specified and explicitly notified shall lapse by the mere passage of twelve (12) months after the claim arose.
Article 12. Duration and termination
12.1. This Data Processing Agreement is concluded by electronic registration for a Service or Additional Service via, for example, the website of Cremers Computer Company.
12.2. This Data Processing Agreement enters into force upon signature by the Parties and on the date of the last signature.
12.3. This Data Processing Agreement is entered into for the duration as determined in the main agreement between the Parties and, failing that, in any event for the duration of the cooperation.
12.4. As soon as the Processor Agreement is terminated, for whatever reason and in whatever manner, the Processor shall – at the option of the Controller – return all personal data in its possession, in original or copy form, to the Controller, and/or delete and/or destroy these original personal data and any copies thereof.
12.5. This Data Processing Agreement may be amended in the same manner as the Main Agreement.
Definitions
The names and concepts in this Addendum that are written with a capital letter have the following meaning:
“Data leak(s)“
A personal data breach, or any security breach that accidentally or unlawfully results in the destruction, loss, alteration, or unauthorized disclosure of, or unauthorized access to, transmitted, stored, or otherwise processed data;
“The person(s) concerned”
The person to whom Personal Data relates;
“Processor”
Cremers Computer Company, being the (legal) person that processes Personal Data on behalf of the Data Controller;
“Agreement”
The Agreement concluded between the Parties regarding the services provided by Cremers Computer Company to the Customer, of which this Addendum forms an annex;
“Parties”
Cremers Computer Company and the Customer, jointly;
“Personal data(s)”
All information about an identified or identifiable natural person;
“Privacy legislation”
All applicable laws and regulations on the processing of personal data – but not limited to – the General Data Protection Regulation;
“Sub-processor”
The (legal) person who, in turn, processes Personal Data on behalf of Cremers Computer Company;
“Controller(s)”
Customer, being the (legal) person who (alone or together with others) determines the purpose and means for the Processing of personal data and is obliged under Privacy legislation to take the safeguards necessary for such Processing;
“Processing”
Any operation or set of operations performed on personal data or on a set of personal data, whether or not performed automatically, such as collection, recording, organization, structuring, storage, updating or modification, retrieval, consultation, use, provision by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data.
Appendix 1.1: Specification of personal data and data subjects
Personal data
Processor shall process the following (special) personal data on behalf of the Controller pursuant to Article 1.1 of the Data Processing Agreement:
name and address details
Phone number
Email address
Visiting behavior
IP address
Financial data
Of the categories of stakeholders:
Customers
Website visitors
The Controller warrants that the personal data and categories of data subjects described in this Appendix 1.1 are complete and correct, and indemnifies the Processor against any defects and claims resulting from an incorrect representation by the Controller.
Appendix 2.1: Data center and network security
a) Data center
Infrastructure. Cremers Computer Company has geographically distributed data centers. Cremers Computer Company stores all production data in physically secured data centers.
Redundancy. The infrastructure systems are designed to eliminate single points of failure and minimize the impact of anticipated environmental risks. To achieve this redundancy, dual circuits, switches, networks, and other necessary instruments are utilized. The Processing Services have been developed to enable Cremers Computer Company to perform certain forms of preventive and corrective maintenance without interruption. All environmental protection devices and facilities have documented preventive maintenance procedures describing the procedure and frequency of execution in accordance with manufacturer specifications or internal specifications. Preventive and corrective maintenance of the data center equipment is scheduled using a standard procedure in accordance with documented procedures.
Current. Data center power supplies are designed to be redundant and maintainable without impacting continuous operations, 24 hours a day, 7 days a week. In most cases, critical infrastructure components in a data center have a primary and an alternate power source, each with the same capacity. Emergency power is provided by various mechanisms, such as uninterruptible power supply (UPS) batteries, which provide always-reliable power protection during utility voltage drops, overvoltage, undervoltage, and conditions where frequencies exceed tolerance limits. In the event of a grid power failure, a backup power supply ensures temporary power to the data center at full capacity for up to 10 minutes until the diesel generators take over. These diesel generators can start up within a few seconds to supply enough emergency power to keep the data center operating at full capacity, usually for a period of several days.
Business Continuity/Backup. Cremers Computer Company replicates data in multiple systems to protect against unforeseen destruction or loss. Automatic backups of your data are made on all Cremers Computer Company servers. These backups are created every 4 to 6 hours with a total retention of up to 36 to 54 hours. In addition to the automatic backups, backups of individual files, such as websites and email, are also made to a secure backup server, provided you have entered into a maintenance agreement with Cremers Computer Company.
b) Networks and transfer.
Data transfer. Data centers are usually connected via private high-speed links to ensure secure and fast data transfer between data centers. This is designed to prevent data from being read, copied, modified, or deleted without permission during electronic exchange or transmission, or during recording on data storage media. Cremers Computer Company transmits data via standard Internet protocols.
Risk of external attacks. Cremers Computer Company utilizes multiple layers of network devices and intrusion detection to protect against the risk of external attacks. Cremers Computer Company takes potential attack vectors into account and integrates appropriate specially developed technologies into outward-facing systems.
Intrusion detection. Intrusion detection is intended to provide insight into current attack activities and sufficient information to respond to incidents. The intrusion detection from Cremers Computer Company includes:
1. Strict control of the scope and composition of the attack risk of Cremers Computer Company by means of preventive measures;
2. Use of intelligent detection controls at data entry points; and
3. Use of technologies that automatically remedy certain dangerous situations.
Incident response. Cremers Computer Company monitors a range of communication channels for security incidents, and Cremers Computer Company's security personnel respond quickly to incidents.
Encryption technologies. Cremers Computer Company makes HTTPS encryption (also known as SSL or TLS connection) available.
