Data Processing Agreement (DPA)

This Data Processing Agreement (the “DPA”), including the appendix below, forms part of our Terms of Use for Businesses and applies only to the extent stated therein (see the Privacy and Data Usage section).

Definitions

Words or expressions placed in “quotation marks” have the same meaning each time they are used in this DPA. Unless stated otherwise below, all words or expressions defined in the Terms of Use for Businesses have the same meaning when used in this DPA as well.

• “Applicable data protection law” means all laws and regulations applicable to the processing of relevant data by Klantenvertellen BV under the Terms of Use for Businesses, including the GDPR and all laws and/or regulations enacted pursuant to, or enacted by or arising under the GDPR
• “Personal data”, “special categories of personal data”, “controller” and “processor” have the meanings as defined in the GDPR.
• “Klantenvertellen BV”, “we”, “us” or “our” means Klantenvertellen BV (Chamber of Commerce number: 81275048), Steenweg 79, 5301 HK Zaltbommel, Netherlands.

Instructions

1. To the extent Klantenvertellen BV provides you with review invitation services and you are a controller of the Relevant Data under the GDPR, you (the Controller) appoint Klantenvertellen BV as Processor to process the Relevant Data.

2. This Data Processing Agreement applies to you and us for as long as our Terms of Use and Sales Terms for Businesses apply to you, or as long as we process Relevant Data on your behalf: whichever term is longer.

3. You instruct Klantenvertellen BV to process the Relevant Data in accordance with this Data Processing Agreement (DPA) and solely for the purpose described in the attached appendix below (or as otherwise agreed in writing between you and Klantenvertellen BV) (the “Purpose”). Klantenvertellen BV may not process the Relevant Data for other purposes unless required by EU law, EU member state law or Dutch law. In such case Klantenvertellen BV will inform you in writing of the reasons why it must process the Relevant Data, unless it is legally restricted from informing you.

4. If Klantenvertellen BV believes that any instruction you have given is in conflict with the Applicable Data Protection Law, Klantenvertellen BV will inform you of this immediately.

5. Klantenvertellen BV is not currently aware of legislation that would prevent it from complying with the Data Processing Agreement, but will promptly inform you if this changes or is expected to change.

Transfer of Relevant Data

6. Klantenvertellen BV will not transfer the Relevant Data outside the EU unless Klantenvertellen BV has taken the necessary measures to ensure that the transfer complies with applicable data protection law.

Confidentiality

7. Klantenvertellen BV will ensure that any person authorized by Klantenvertellen BV to process the Relevant Data will keep the Relevant Data confidential under a legal obligation of confidentiality or other obligation.

Security Measures

8. Klantenvertellen BV currently implements the technical and organizational measures described in our DPA on security measures for Klantenvertellen BV

9. Klantenvertellen BV may change these measures from time to time, but will always maintain appropriate technical and organizational measures that ensure a security level appropriate to the risk and that protect the Relevant Data against:

• unauthorized or unlawful destruction, loss or alteration,
• disclosure or making available without authorization, or
• other processing in breach of applicable data protection law.

1

0. Klantenvertellen BV will also comply with all other applicable data security requirements directly imposed on it, including data security requirements of the country where Klantenvertellen BV is based and where the data processing will take place.

11. The suitability of the technical and organizational security measures is based on:

• the current state of the art;
• the costs of implementation; and
• the nature, scope, context and purposes of the processing, as well as the likelihood of risks and the impact on the data protection rights and freedoms of data subjects.

1

2. Upon your request Klantenvertellen BV will provide you with sufficient information to enable you to verify that Klantenvertellen BV complies with its obligations under the Data Protection Agreement, including the implementation of the above-mentioned technical and organizational security measures.

Audit

1

4. You may appoint at your own expense an independent expert who (as long as the expert is not a competitor of Klantenvertellen BV) will have access to Klantenvertellen BV's premises and the information necessary to verify whether Klantenvertellen BV complies with its obligations under the Data Processing Agreement, including the question whether the appropriate technical and organizational security measures have been implemented.

15. You must give us at least 14 days' notice that you want your expert to have access. Before we grant him or her access, he or she must sign a standard confidentiality agreement with Klantenvertellen BV guaranteeing that all information that he or she obtains or receives from Klantenvertellen BV and/or its affiliates will be treated as confidential and that this information may only be shared with you.

16. All findings or reports prepared based on the inspection and audit of the expert must be shared with Klantenvertellen BV and treated as confidential information.

Authorities Requests

1

7. Klantenvertellen BV shall grant authorities who under EU law have the right to enter the facilities of your suppliers access to the physical facilities of Klantenvertellen BV, provided their representatives can show valid identification.

18. Klantenvertellen BV must inform you, without undue delay after it becomes aware of the facts, in writing of any request by an authority to disclose the Relevant Data, unless Klantenvertellen BV is expressly prohibited from informing you under EU law.

Security Incidents

1

9. Klantenvertellen BV must inform you, without undue delay after it becomes aware of the facts, in writing of any suspicion or finding of:

• a security breach that results in unintended or unlawful destruction, loss or alteration, unauthorized disclosure of or access to the Relevant Data that Klantenvertellen BV transmits, stores or otherwise

1

8. Klantenvertellen BV must inform you, without undue delay after it becomes aware of the facts, in writing of any request by an authority for disclosure of the Relevant Data, unless Klantenvertellen BV is expressly prohibited from informing you under EU law.

Cooperation and Rights of Data Subjects

2

0. Klantenvertellen BV will immediately assist you in handling data subject requests under Chapter III of the GDPR and, where commercially feasible, under other applicable data protection laws, including requests for access, rectification, blocking or deletion, relating to our processing of the relevant data.

21. If Klantenvertellen BV receives such a request, Klantenvertellen BV will not respond to it, except by informing the data subject:

• whether an email inviting the data subject to review has been sent on your behalf; and
• that he/she must submit his/her request to you, since you are responsible for answering these requests.

2

2. Klantenvertellen BV will assist you in complying with other obligations that may be imposed on you under EU law, the laws of EU member states or UK law relating to data processing, if our assistance is necessary to meet your obligations. This includes providing reasonable cooperation regarding a data protection impact assessment that may be required under Articles 35 and 36 of the GDPR.

Subprocessors

2

5. Klantenvertellen BV may engage external subprocessors to process the Relevant Data for the Purpose, provided Klantenvertellen BV imposes data protection obligations on each subprocessor requiring that the Relevant Data be protected to at least the same standard as the one applied to Klantenvertellen BV under this DPA. Klantenvertellen BV lists its current subprocessors here. If Klantenvertellen BV intends to add a new subprocessor, Klantenvertellen BV will inform you in advance.

26. You may object to an additional or replacement subprocessor before it is appointed, provided your objection is based on objective and reasonable grounds regarding data protection. If Klantenvertellen BV chooses not to propose an alternative subprocessor, or if you object to all alternative subprocessors of Klantenvertellen BV, you may terminate your subscription (if applicable) with a notice period of one month at the end of the month.

27. Upon your request we will provide you with a copy of the data protection obligations in the agreement between Klantenvertellen BV and the subprocessor.

28. Klantenvertellen BV is liable for any breach of this Data Processing Agreement caused by an act, fault or omission of one or more of its subprocessors.

Deletion or Return of Relevant Data

2

9. Klantenvertellen BV retains the Relevant Data for the following retention periods:

• After a period of 3 months, email addresses and IP addresses are deleted or anonymized.

3

0. After these retention periods, or at your earlier request, Klantenvertellen BV will promptly return or delete (including anonymizing) the Relevant Data in a manner and form reasonably determined by Klantenvertellen BV. This does not apply to the extent Klantenvertellen BV is legally obliged to retain all or part of the Relevant Data. Data Protection Officer You can reach our Data Protection Officer by emailing: [email protected]

Purpose

• You provide one or more of our services for inviting reviews, as defined in the Terms of Use for Businesses (when you (or we on your behalf) send invitations to your consumers asking them to write a review on our platform about your services and/or your products). Categories of data subjects
• Your customers' categories of personal data
• Name
• City of residence
• Email address
• Potential: reference number, such as an order number or similar
• IP address