{"id":16891,"date":"2018-07-26T12:05:53","date_gmt":"2018-07-26T12:05:53","guid":{"rendered":"https:\/\/www.c3ict.nl\/?page_id=16891"},"modified":"2021-08-24T12:08:00","modified_gmt":"2021-08-24T12:08:00","slug":"verwerkingsovereenkomst","status":"publish","type":"page","link":"https:\/\/c3ict.nl\/en\/verwerkingsovereenkomst\/","title":{"rendered":"Processing agreement"},"content":{"rendered":"
\t

Appendix 1:
\r\nData Processing Agreement<\/h1>\r\n

Read the Data Processing Agreement of Cremers Computer Company here<\/h3>\r\n

Data Processing Addendum (Appendix General Terms and Conditions)<\/p>\r\n

This Data Processing Agreement is an annex to \u201cthe General Terms and Conditions for the Provision of Hosting\/ICT Services of Cremers Computer Company, available at: https:\/\/www.cremerscomputers.nl\/algemene-voorwaarden\/\u201d (hereinafter: the Main Agreement) between the Customer (hereinafter: Controller) and Cremers Computer Company (hereinafter: Processor).<\/p>\r\n

Cremers Computer Company will process Personal Data on behalf of its customers during or in connection with the provision of its Services. Pursuant to Privacy Legislation, the Customer is designated in this capacity as the Controller of the Processing of Personal Data and Cremers Computer Company as the Processor. This Addendum contains the terms and conditions of this Processing of Personal Data by Cremers Computer Company.<\/p>\r\n

Article 1. Purposes of processing<\/h3>\r\n1.1. The Processor undertakes, under the terms of this Data Processing Agreement, to process personal data on behalf of the Data Controller. Processing shall take place exclusively within the framework of the Main Agreement, specifically for the purpose of storing the Data Controller's data in the \u2018cloud\u2019 and associated online services, hosting of websites and servers, plus those purposes reasonably connected therewith or determined by further consent.
\r\n1.2. The personal data processed by the Processor in the context of the activities referred to in the previous paragraph and the categories of data subjects from whom they originate are listed in Appendix 1. The Processor shall not process the personal data for any purpose other than as determined by the Controller. The Controller shall inform the Processor of the processing purposes insofar as these are not already mentioned in this Data Processing Agreement.
\r\n1.3. The personal data to be processed on behalf of the Controller remain the property of the Controller and\/or the relevant data subjects.\r\n

Article 2. Obligations of the Processor<\/h3>\r\n2.1. With regard to the processing operations referred to in Article 1, the Processor shall ensure compliance with applicable laws and regulations, including in any event laws and regulations regarding the protection of personal data, such as the Personal Data Protection Act.
\r\n2.2. The Processor shall inform the Controller, at the latter's first request to that effect, of the measures taken by the Processor regarding its obligations under this Data Processing Agreement.
\r\n2.3. The obligations of the Processor arising from this Processor Agreement also apply to those who process personal data under the authority of the Processor, including but not limited to employees, in the broadest sense of the word.
\r\n2.4. The Processor shall immediately notify the Controller if, in its opinion, an instruction from the Controller is contrary to the legislation referred to in paragraph 1.
\r\n2.5. The Processor shall, to the extent within its power, provide assistance to the Controller for the purpose of conducting data protection impact assessments (PIAs).\r\n

Article 3. Transfer of personal data<\/h3>\r\n3.1. Cremers Computer Company will only transfer Personal Data to a country outside the European Economic Area if that country guarantees an adequate level of protection and complies with the other obligations incumbent upon it under this Addendum and Privacy Legislation.
\r\n3.2. If the Customer transfers personal data to countries outside the European Union by means of the services, the Customer shall indemnify Cremers Computer Company against all legal claims by third parties based on the assertion that such personal data is transferred in violation of the provisions of the GDPR.\r\n

Article 4. Division of responsibility<\/h3>\r\n4.1. The permitted processing operations are carried out in a fully automated manner under the control of the Processor.
\r\n4.2. The Processor is solely responsible for the processing of personal data under this Data Processing Agreement, in accordance with the instructions of the Controller and under the express (ultimate) responsibility of the Controller. The Processor is expressly not responsible for any other processing of personal data, including, but not limited to, the collection of personal data by the Controller, processing for purposes not notified by the Controller to the Processor, processing by third parties and\/or for other purposes.
\r\n4.3. The Controller guarantees that the content, use, and instruction for the processing of the personal data as referred to in this Data Processing Agreement are not unlawful and do not infringe upon any rights of third parties.\r\n

Article 5. Engaging third parties or subcontractors<\/h3>\r\n5.1. The Processor may use third parties within the framework of this Processor Agreement provided that such use is notified to the Controller in advance; the Controller may object if the use of a specific notified third party is unacceptable to it.
\r\n5.2. The Processor shall in any event ensure that these third parties assume in writing at least the same obligations as have been agreed between the Controller and the Processor.
\r\n5.3. The Processor guarantees the proper compliance with the obligations under this Data Processing Agreement by these third parties and, in the event of errors by these third parties, is itself liable for all damages as if it had committed the error(s) itself.\r\n

Article 6. Security<\/h3>\r\n6.1. The Processor shall endeavor to take sufficient technical and organizational measures with regard to the processing of personal data to be performed, against loss or against any form of unlawful processing (such as unauthorized access, alteration, modification, or disclosure of the personal data).
\r\n6.2. The Processor does not guarantee that the security will be effective under all circumstances. If an expressly described security measure is missing from the Processing Agreement, the Processor shall endeavor to ensure that the security meets a level that is not unreasonable, having regard to the state of the art, the sensitivity of the personal data, and the costs associated with implementing the security.
\r\n6.3. The Controller shall only make personal data available to the Processor for processing if it has ensured that the required security measures have been taken. The Controller is responsible for compliance with the measures agreed upon by the Parties.\r\n

Article 7. Reporting obligation<\/h3>\r\n7.1. The Controller is at all times responsible for reporting a security breach and\/or data breach (which means: a breach of the security of personal data that results in a risk of adverse consequences, or has adverse consequences, for the protection of personal data) to the supervisory authority and\/or data subjects. In order to enable the Controller to comply with this legal obligation, the Processor shall notify the Controller of the security breach and\/or data breach within 48 hours after the breach has become known to it.
\r\n7.2. A report must always be made, but only if the event has actually occurred.
\r\n7.3. The reporting obligation entails, in any case, reporting the fact that a leak has occurred. In addition, the reporting obligation entails:
\r\n\u2022 the nature of the personal data breach, where possible indicating the categories of data subjects and personal data records concerned and, approximately, the number of data subjects and personal data records concerned;
\r\n\u2022 the name and contact details of the Data Protection Officer or another contact point where more information can be obtained;
\r\n\u2022 the likely consequences of the personal data breach;
\r\n\u2022 the measures proposed or taken by the Processor to address the personal data breach, including, where applicable, measures to mitigate any adverse effects thereof.
\r\n7.4. Cremers Computer Company shall provide further information regarding the Data Breach at the Customer's request, to the extent necessary for the Customer to comply with its legal obligations regarding notification to the Dutch Data Protection Authority and Data Subjects.
\r\n7.5. The Customer is obliged to actively assist Cremers Computer Company in the event of a Data Breach and the resulting reporting obligation for Cremers Computer Company to the Dutch Data Protection Authority pursuant to the Telecommunications Act.\r\n

Article 8. Handling requests from data subjects<\/h3>\r\n8.1. In the event that a data subject addresses a request to exercise his\/her legal rights to the Processor, the Processor shall forward the request to the Controller, and the Controller shall handle the request further. The Processor may notify the data subject thereof.
\r\n8.2. In the event of a request for access, rectification, deletion, or restriction of processing, Cremers Computer Company shall cooperate by providing, as soon as possible but no later than ten working days after the Customer requests Cremers Computer Company to do so, all information that the Customer needs to comply with the request or to proceed with the rectification, deletion, or blocking of the Personal Data indicated by the Customer, insofar as the Customer does not have independent access to these data through the services provided by Cremers Computer Company. The processor shall charge no more than reasonable costs for this (max. \u20ac 100 per hour for direct hours only).\r\n

Article 9. Secrecy and confidentiality<\/h3>\r\n9.1. All personal data that the Processor receives from the Controller and\/or collects itself within the framework of this Data Processing Agreement is subject to a duty of confidentiality towards third parties. The Processor shall not use this information for any purpose other than that for which it was obtained, even if it has been transformed into a form such that it cannot be traced back to the data subjects.
\r\n9.2. This duty of confidentiality does not apply to the extent that the Controller has given express permission to provide the information to third parties, if providing the information to third parties is logically necessary given the nature of the assignment provided and the execution of this Data Processing Agreement, or if there is a legal obligation to provide the information to a third party.\r\n

Article 10. Audit<\/h3>\r\n10.1. The Controller has the right to have audits performed by an independent third party bound by confidentiality to verify the misuse of personal data by employees of the Processor, compliance with all points of the Data Processing Agreement, and everything directly related thereto.
\r\n10.2. This audit may take place in the event of a concrete suspicion of misuse of personal data.
\r\n10.3. The Processor shall cooperate with the audit and make all information reasonably relevant to the audit, including supporting data such as system logs, and employees available as timely as possible.
\r\n10.4. The findings resulting from the conducted audit will be implemented by the Processor as soon as possible.
\r\n10.5. The costs of the audit shall be borne by the Controller. The Processor shall not charge more than reasonable costs for this (max. \u20ac 100 per hour for direct hours only).\r\n

Article 11. Liability<\/h3>\r\n11.1. The liability of the Parties for damage resulting from an attributable failure to perform the Data Processing Agreement, or from tort or otherwise, is limited per event (a series of consecutive events counts as one event) to compensation for direct damage, up to a maximum of the amount of fees received by the other Party for the work performed under this Data Processing Agreement during the month preceding the damage-causing event. The total liability of the Parties for direct damage shall never exceed \u20ac 3,000.00.
\r\n11.2. Direct damage shall exclusively mean all damage consisting of:
\r\n\u2022 damage caused directly to tangible property (\u201cproperty damage\u201d);
\r\n\u2022 reasonable and demonstrable costs to urge the party concerned to properly comply with the Data Processing Agreement (again);
\r\n\u2022 reasonable costs for determining the cause and extent of the damage insofar as it relates to the direct damage as referred to herein; and
\r\n\u2022 redelijke en aantoonbare kosten die Verwerkingsverantwoordelijke heeft gemaakt ter voorkoming of beperking van de directe schade zoals in dit artikel bedoeld.\r\n11.3. De aansprakelijkheid van Partijen voor indirecte schade is uitgesloten. Onder indirecte schade wordt verstaan alle schade die geen directe schade is en daarmee in ieder geval, maar niet beperkt tot, gevolgschade, gederfde winst, gemiste besparingen, verminderde goodwill, schade door bedrijfsstagnatie, schade door het niet bepalen van marketingdoeleinden, schade verband houdende met het gebruik van door Verwerkingsverantwoordelijke voorgeschreven gegevens of databestanden, of verlies, verminking of vernietiging van gegevens of databestanden.
\r\n11.4. The exclusions and limitations referred to in this article shall cease to apply if and to the extent that the damage is the result of intent or willful recklessness on the part of the Party concerned or its management.
\r\n11.5. Unless performance by the relevant Party is permanently impossible, the liability of that Party for attributable failure to perform the Agreement shall arise only if the one Party gives the other Party written notice of default without delay, setting a reasonable period for remedying the default, and the other Party continues to be in attributable default in the performance of its obligations even after such period. The notice of default shall contain as complete and detailed a description of the default as possible, so that the relevant Party is given the opportunity to respond adequately.
\r\n11.6. Any claim for damages by one Party against the other Party that has not been specified and explicitly notified shall lapse by the mere passage of twelve (12) months after the claim arose.\r\n

Article 12. Duration and termination<\/h3>\r\n12.1. This Data Processing Agreement is concluded by electronic registration for a Service or Additional Service via, for example, the website of Cremers Computer Company.
\r\n12.2. This Data Processing Agreement enters into force upon signature by the Parties and on the date of the last signature.
\r\n12.3. This Data Processing Agreement is entered into for the duration as determined in the main agreement between the Parties and, failing that, in any event for the duration of the cooperation.
\r\n12.4. As soon as the Processor Agreement is terminated, for whatever reason and in whatever manner, the Processor shall \u2013 at the option of the Controller \u2013 return all personal data in its possession, in original or copy form, to the Controller, and\/or delete and\/or destroy these original personal data and any copies thereof.
\r\n12.5. This Data Processing Agreement may be amended in the same manner as the Main Agreement.\r\n

Definitions<\/strong><\/p>\r\n

The names and concepts in this Addendum that are written with a capital letter have the following meaning:<\/p>\r\n\u201cData leak(s)\u201c<\/em>
\r\nA personal data breach, or any security breach that accidentally or unlawfully results in the destruction, loss, alteration, or unauthorized disclosure of, or unauthorized access to, transmitted, stored, or otherwise processed data;\r\n\u201cThe person(s) concerned\u201d<\/em>
\r\nThe person to whom Personal Data relates;\r\n\u201cProcessor\u201d<\/em>
\r\nCremers Computer Company, being the (legal) person that processes Personal Data on behalf of the Data Controller;\r\n\u201cAgreement\u201d<\/em>
\r\nThe Agreement concluded between the Parties regarding the services provided by Cremers Computer Company to the Customer, of which this Addendum forms an annex;\r\n\u201cParties\u201d<\/em>
\r\nCremers Computer Company and the Customer, jointly;\r\n\u201cPersonal data(s)\u201d<\/em>
\r\nAll information about an identified or identifiable natural person;\r\n\u201cPrivacy legislation\u201d<\/em>
\r\nAlle toepasselijke wet- en regelgeving op de verwerking van persoonsgegevens – doch niet beperkt tot – de Algemene Verordening Gegevensbescherming;\r\n\u201cSub-processor\u201d<\/em>
\r\nThe (legal) person who, in turn, processes Personal Data on behalf of Cremers Computer Company;\r\n\u201cController(s)\u201d<\/em>
\r\nCustomer, being the (legal) person who (alone or together with others) determines the purpose and means for the Processing of personal data and is obliged under Privacy legislation to take the safeguards necessary for such Processing;\r\n\u201cProcessing\u201d<\/em>
\r\nAny operation or set of operations performed on personal data or on a set of personal data, whether or not performed automatically, such as collection, recording, organization, structuring, storage, updating or modification, retrieval, consultation, use, provision by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data.\r\n

Appendix 1.1: Specification of personal data and data subjects<\/h1>\r\n

Personal data<\/h3>\r\n

Processor shall process the following (special) personal data on behalf of the Controller pursuant to Article 1.1 of the Data Processing Agreement:<\/p>\r\nname and address details
\r\nPhone number
\r\nEmail address
\r\nVisiting behavior
\r\nIP address
\r\nFinancial data\r\n

Of the categories of stakeholders:<\/p>\r\nCustomers
\r\nWebsite visitors\r\n

The Controller warrants that the personal data and categories of data subjects described in this Appendix 1.1 are complete and correct, and indemnifies the Processor against any defects and claims resulting from an incorrect representation by the Controller.<\/p>\r\n

Appendix 2.1: Data center and network security<\/h1>\r\n

a) Data center<\/h3>\r\n

Infrastructure.<\/em> Cremers Computer Company has geographically distributed data centers. Cremers Computer Company stores all production data in physically secured data centers.<\/p>\r\n

Redundancy.<\/em> De infrastructuursystemen zijn ontworpen om zwakke punten (\u201csingle points of failure\u201d) te verwijderen en de impact van verwachte milieurisico’s te minimaliseren. Om deze redundantie te realiseren wordt gebruik gemaakt van dubbele circuits, schakelaars, netwerken en andere noodzakelijke instrumenten. De Verwerkingsdiensten zijn ontwikkeld om Cremers Computer Company in staat te stellen om bepaalde vormen van preventief en correctief onderhoud zonder onderbreking te kunnen uitvoeren. Alle milieubeschermende apparaten en faciliteiten hebben gedocumenteerde procedures voor preventief onderhoud waarin de procedure voor en frequentie van uitvoering worden beschreven in overeenstemming met de specificaties van de fabrikant of de interne specificaties. Preventief en correctief onderhoud van de datacenter-apparatuur wordt gepland door middel van een standaardprocedure in overeenstemming met gedocumenteerde procedures.<\/p>\r\n

Current.<\/em> De elektriciteitsvoorzieningen van de datacenters zijn ontworpen om redundant te zijn en onderhouden te kunnen worden zonder gevolgen voor continue processen, 24 uur per dag en 7 dagen per week. In de meeste gevallen hebben onderdelen van kritieke infrastructuur in een datacenter een primaire en een alternatieve stroombron, elk met hetzelfde vermogen. Noodstroom wordt verschaft door verschillende mechanismen, zoals noodstroomvoorziening (UPS)-accu’s, die een altijd betrouwbare stroombeveiliging verschaffen tijdens spanningsdalingen van nutsvoorzieningen, overspanning, onderspanning en omstandigheden waarbij frequenties de tolerantiegrenzen overschrijden. In het geval de netstroom uitvalt, zorgt een reserve energievoorziening voor tijdelijke stroomvoorziening aan het datacenter, op volledige capaciteit, gedurende maximaal 10 minuten totdat de dieselgeneratoren de stroomvoorziening overnemen. Deze dieselgeneratoren kunnen binnen een aantal seconden opstarten om genoeg noodstroom te leveren om het datacenter op volledige capaciteit te laten werken, meestal voor een periode van een aantal dagen.<\/p>\r\n

Business Continuity\/Backup.<\/em> Cremers Computer Company replicates data in multiple systems to protect against unforeseen destruction or loss. Automatic backups of your data are made on all Cremers Computer Company servers. These backups are created every 4 to 6 hours with a total retention of up to 36 to 54 hours. In addition to the automatic backups, backups of individual files, such as websites and email, are also made to a secure backup server, provided you have entered into a maintenance agreement with Cremers Computer Company.<\/p>\r\n

b) Networks and transfer.<\/h3>\r\n

Data transfer.<\/em> Data centers are usually connected via private high-speed links to ensure secure and fast data transfer between data centers. This is designed to prevent data from being read, copied, modified, or deleted without permission during electronic exchange or transmission, or during recording on data storage media. Cremers Computer Company transmits data via standard Internet protocols.<\/p>\r\n

Risk of external attacks. <\/em>Cremers Computer Company utilizes multiple layers of network devices and intrusion detection to protect against the risk of external attacks. Cremers Computer Company takes potential attack vectors into account and integrates appropriate specially developed technologies into outward-facing systems.<\/p>\r\nIntrusion detection.<\/em> Intrusion detection is intended to provide insight into current attack activities and sufficient information to respond to incidents. The intrusion detection from Cremers Computer Company includes:
\r\n1. Strict control of the scope and composition of the attack risk of Cremers Computer Company by means of preventive measures;
\r\n2. Use of intelligent detection controls at data entry points; and
\r\n3. Use of technologies that automatically remedy certain dangerous situations.\r\nIncident response.<\/em> Cremers Computer Company monitors a range of communication channels for security incidents, and Cremers Computer Company's security personnel respond quickly to incidents.
\r\nEncryption technologies. Cremers Computer Company makes HTTPS encryption (also known as SSL or TLS connection) available.\r\n\n

\n

<\/p>

    <\/ul><\/div>\n
    \n
    \n\n\n\n\n\n\n\n<\/div>\n

    Agreement on data processing agreement Cremers Computer Company | bosen<\/b>\n<\/p>\n

    Your name (required)\n<\/p>\n

    <\/span>\n<\/p>\n

    Company name\n<\/p>\n

    <\/span>\n<\/p>\n

    Your email (required)\n<\/p>\n

    <\/span>\n<\/p>\n

    Remark\n<\/p>\n