Data Processing Agreement (DPA)

1. Parties

2. Subject matter and nature of processing

The Processor processes personal data on behalf of the Controller for the purpose of delivering the PrikKlokPlus service: time tracking, scrum planning, project management, CRM, and invoicing.

3. Obligations of the Processor

The Processor shall:

• Process personal data only on documented instructions from the Controller, unless required to do so by EU or member state law (GDPR art. 28(3)(a))
• Ensure that authorised personnel are bound by confidentiality obligations (art. 28(3)(b))
• Implement appropriate technical and organisational security measures as described in §5 (art. 28(3)(c), art. 32)
• Respect the conditions for engaging sub-processors as described in §6 (art. 28(2))
• Assist the Controller in responding to data subject rights requests (art. 28(3)(e))
• Assist the Controller with security obligations, breach notification, DPIA, and prior consultation (art. 28(3)(f))
• At the Controller's choice, delete or return all personal data after the end of the provision of services (art. 28(3)(g))
• Make available all information necessary to demonstrate compliance, and allow for and contribute to audits (art. 28(3)(h))

4. Obligations of the Controller

The Controller shall:

• Ensure there is a valid legal basis for processing under GDPR art. 6 (and art. 9 if applicable)
• Provide accurate and up-to-date instructions to the Processor
• Not instruct the Processor to process data in a way that would violate applicable law
• Maintain accurate records of processing activities (art. 30) insofar as required by the Controller's role

5. Security measures

6. Sub-processors

The Controller grants general written authorisation for the use of the following sub-processors. PrikKlokPlus will inform the Controller of intended additions or replacements at least 30 days in advance, giving the Controller the opportunity to object.

7. International transfers

Where personal data is transferred to countries outside the European Economic Area (EEA), the Processor shall ensure adequate protection through one of the following mechanisms:

• EU Standard Contractual Clauses (SCCs) adopted by European Commission decision 2021/914
• EU-US Data Privacy Framework (where the sub-processor is certified)
• Any other valid transfer mechanism recognised under GDPR chapter V

8. Data subject rights assistance

The Processor shall, taking into account the nature of processing, assist the Controller by appropriate technical and organisational measures to fulfil obligations to respond to data subject requests:

• Data export: Controllers can export all Tenant data via Settings → Data export (JSON and CSV formats available)
• Account/data deletion: Controllers can close the Tenant account, after which all associated data is purged within 60 days
• Individual user deletion: Manager-role users can delete individual user accounts via admin panel
• Manual assistance: For complex data subject requests not supported by self-service, contact privacy@prikklokplus.nl

9. Audit rights

The Processor shall make available all information necessary to demonstrate compliance with this DPA and GDPR art. 28. The Controller may request an audit of the Processor's data processing activities with at least 30 days advance notice and no more than once per 12-month period. Costs of audits are borne by the Controller unless the audit reveals a material breach by the Processor.

10. Duration and termination

This DPA is effective from the date the Controller accepts the General Terms and Conditions and remains in force for the duration of the subscription agreement. Upon termination, the Processor will retain data for 60 days to allow the Controller to export data, after which all personal data is permanently deleted, except where retention is required by law (e.g. invoice data under the Dutch VAT Act — 7 years).

11. Contact