Sint Hill Technology B.V. as processor - version 1.0, effective 1 November 2026

This is a translation. In case of any discrepancy, the Dutch text prevails.

Download PDF | Nederlandse versie

Parties:

1. the client with whom Sint Hill Technology B.V. has concluded the Main Agreement, as named in that Main Agreement, hereinafter: "Controller";

2. Sint Hill Technology B.V., having its registered office in Amersfoort, with its business address at Van Asch van Wijckstraat 55, 3811 LP Amersfoort, registered with the Dutch Chamber of Commerce under number 42181319, hereinafter: "Processor";

hereinafter jointly: "Parties".

Whereas:

1. the Parties have entered into one or more agreements under which Processor provides services to Controller, including quotations, order confirmations and statements of work, together with Processor's general terms and conditions applicable thereto (together the "Main Agreement"). In performing the Main Agreement, Processor processes personal data on behalf of Controller;
2. Article 28 of the General Data Protection Regulation ("GDPR") requires the Parties to lay down arrangements in this respect;
3. the Parties wish to lay down those arrangements in this data processing agreement (the "Agreement");
4. this Agreement applies if the Parties sign it or, if the Parties have not concluded another data processing agreement, on the basis of Processor's general terms and conditions;
5. the Parties shall provide each other in good time with all information necessary for proper compliance with the GDPR.

Have agreed as follows:

Article 1 - Definitions

1. Terms in this Agreement have the meaning given to them in the GDPR, including personal data, processing, data subject, controller, processor and personal data breach ("Personal Data Breach").
2. Sub-processor: another processor engaged by Processor for specific processing activities on behalf of Controller.
3. Annex 1: the specification of the processing: subject matter, nature, purpose, types of personal data, categories of data subjects, retention periods and the approved Sub-processors.
4. Annex 2: the technical and organisational security measures of Processor.

Article 2 - Subject matter and instructions

1. Processor processes personal data only on behalf of Controller, to the extent necessary for the performance of the Main Agreement and in accordance with the written instructions of Controller as laid down in this Agreement, the Main Agreement and Annex 1. Processing that is required under Union or Member State law is not covered by this provision. In that case, Processor informs Controller in advance, unless that law prohibits this.
2. Controller determines the purpose and means of the processing. Processor does not take decisions on the use of personal data for its own purposes.
3. If, in Processor's opinion, an instruction infringes the GDPR or other regulations, Processor notifies Controller of this immediately. Processor may suspend the execution of that instruction until Controller has confirmed or amended the instruction.
4. Processor carries out additional or amended instructions that go beyond the agreed services against reimbursement of the reasonable costs involved, at the rates applicable at that time.
5. Controller warrants that:
   • the processing is lawful and has a valid legal basis;
   • data subjects have been sufficiently informed;
   • the personal data provided and the instructions given do not infringe the rights of third parties.

Article 3 - Confidentiality

1. Processor takes appropriate measures to safeguard the confidentiality of the personal data. Processor imposes the same obligation of confidentiality on persons who process personal data on its behalf, including engaged third parties and Sub-processors, unless they are already subject to an appropriate statutory obligation of confidentiality.
2. The obligation of confidentiality does not apply to the extent that Controller has given permission to disclose data to a third party, or to the extent that disclosure is required by law.

Article 4 - Security

1. Processor implements appropriate technical and organisational measures as referred to in Article 32 GDPR. In doing so, it takes into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the likelihood and severity of the risks to the rights and freedoms of data subjects. The measures are set out in Annex 2.
2. Controller informs Processor of the security requirements that apply to the processing. Controller has assessed the measures in Annex 2 and considers them appropriate to the risks of the processing.
3. Processor may adapt the measures to new developments, provided that the level of security does not decrease.
4. If Controller wishes additional measures beyond Annex 2, Processor may implement them against reimbursement of the reasonable costs. Implementation takes place only after written agreement of the Parties.
5. If Processor processes personal data in systems or environments of Controller, Controller is responsible for the security of those systems and environments.

Article 5 - Sub-processors

1. Controller gives Processor general written authorisation to engage Sub-processors. The Sub-processors as at the date of signing are listed in Annex 1 and are hereby approved.
2. Processor informs Controller at least fourteen (14) days in advance of any intended addition or replacement of a Sub-processor. Within that period, Controller may object on reasonable and substantiated grounds. If the Parties do not find a solution, either Party may terminate the relevant services in writing, without liability for damages. Anything already delivered remains payable.
3. Processor imposes in writing on each Sub-processor essentially the same data protection obligations as those in this Agreement. If a Sub-processor fails to fulfil its obligations, Processor remains liable to Controller for this within the limits of Article 11.
4. For standard services of large providers (such as Microsoft), their own standard data processing terms apply. Controller agrees that those terms satisfy paragraph 3.

Article 6 - Transfers outside the EEA

1. Processor processes personal data, in principle, within the European Economic Area. A transfer to a country outside the EEA, including access by a Sub-processor from such a country, takes place only if Chapter V GDPR is complied with. This may be done, for example, by means of an adequacy decision, such as the EU-US Data Privacy Framework for certified recipients, or by means of the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914).
2. Controller consents to the transfers listed in Annex 1.

Article 7 - Personal Data Breaches

1. Processor informs Controller without undue delay, and where possible within twenty-four (24) hours after it has become aware of a Personal Data Breach. The notification is sent to Controller's contact address in Annex 1.
2. Processor provides, to the extent known and, where necessary, in phases, the information that Controller needs to comply with Articles 33 and 34 GDPR:
   • the nature of the Personal Data Breach;
   • the (presumed) categories and number of data subjects and data;
   • the likely consequences;
   • the measures taken and proposed;
   • a contact person.
3. Processor takes reasonable measures to limit the consequences and to prevent recurrence.
4. Controller decides whether a Personal Data Breach is notified to the Dutch Data Protection Authority and/or to data subjects, and makes that notification itself. Controller informs Processor in advance of such a notification, to the extent possible. Processor does not make a notification itself, unless it is legally obliged to do so.
5. A notification or cooperation under this Article is not an acknowledgement of fault or liability. Costs of cooperation that are not the result of an attributable failure on the part of Processor are borne by Controller.

Article 8 - Rights of data subjects and other assistance

1. If Processor receives a request from a data subject (Articles 15 to 22 GDPR), it forwards that request to Controller without delay. Processor does not handle the request itself.
2. Taking into account the nature of the processing and the information available to it, Processor provides Controller with reasonable assistance with:
   • handling requests from data subjects;
   • the obligations under Articles 32 to 36 GDPR, including a data protection impact assessment (DPIA) and prior consultation.
3. The reasonable costs of assistance under this Article are borne by Controller, at the rates applicable at that time.

Article 9 - Information and audit

1. Processor makes available all information necessary to demonstrate compliance with Article 28 GDPR. It does so in the first instance by means of written information, a completed questionnaire, or relevant certifications or audit reports of Processor or its Sub-processors.
2. If that information is insufficient, Controller may have an audit carried out no more than once per calendar year, and in addition after a Personal Data Breach at Processor. The audit is carried out by Controller or by an auditor designated by it who is bound by confidentiality and is not a competitor of Processor, under the following conditions:
   • at least thirty (30) days' prior notice;
   • during office hours;
   • without disproportionate disruption to business operations;
   • without access to data of other customers.
3. An audit is at the expense of Controller, including the time Processor spends on it at the rates applicable at that time. If the audit reveals a material failure on the part of Processor, Processor bears the costs of remedying that failure.
4. Processor provides reasonable cooperation with investigations by the Dutch Data Protection Authority to the extent they relate to the processing, and informs Controller thereof, to the extent permitted.

Article 10 - Duration, termination and return

1. This Agreement applies for as long as Processor processes personal data for Controller. It ends by operation of law when the Main Agreement ends and the data have been returned or deleted. Early termination independently of the Main Agreement is not possible.
2. After the end of the services, Processor, at Controller's choice, does one of the following with the personal data: it returns them in a commonly used format, or it deletes them. Controller makes that choice within thirty (30) days; failing that, Processor deletes the data. Data that must be retained under Union or Member State law are not covered by this provision. Processor confirms deletion in writing on request.
3. Data in back-ups are deleted in accordance with Processor's regular back-up cycle and remain subject to this Agreement until that time.
4. Return in a different format or additional work will be charged at the applicable rates.
5. Provisions which by their nature are intended to continue after termination remain in force. These are in any event confidentiality, liability and applicable law.

Article 11 - Liability

1. The liability of the Parties under this Agreement follows from Article 82 GDPR and the Main Agreement. For Processor, the limitation of liability in the Main Agreement and in Processor's general terms and conditions applicable thereto applies. If no such limitation exists, the following applies. Processor's liability is limited to compensation of direct damage. Per event, it never exceeds the fees (excluding VAT) that Processor invoiced under the Main Agreement in the twelve (12) months before the event giving rise to the damage, up to a maximum of EUR 1,000,000. A series of related events counts as one event. Processor's total liability never exceeds EUR 1,000,000 per calendar year. If Processor's liability insurance pays out in the relevant case, liability is furthermore limited to the amount paid out, plus the deductible. If the insurer does not pay out, for whatever reason, only the foregoing applies, with at least the fee agreed for the assignment as its basis.
2. Processor is not liable for indirect damage or consequential damage. This includes in any event:
   • loss of profit;
   • business interruption;
   • loss of data;
   • reputational damage;
   • fines or penalty payments imposed on Controller, including by the Dutch Data Protection Authority.
3. Controller indemnifies Processor against claims of data subjects and third parties that are connected with the processing, and against the reasonable costs of defending such claims, except to the extent that the damage arose because Processor failed to comply with the obligations of the GDPR specifically directed to processors or with the lawful instructions of Controller (Article 82(2) GDPR). Fines imposed on Processor itself are not covered by this indemnification.
4. Processor is not liable for damage resulting from a breach of the GDPR or other laws or regulations by Controller.
5. If Controller, after a notification by Processor, continues to act in breach of the GDPR or other laws or regulations, Processor may terminate this Agreement and the Main Agreement with immediate effect in writing, without being liable for any compensation.
6. Penalty clauses against Processor in connection with the processing of personal data are excluded, even if they appear in other documents of Controller.
7. The limitations in this Article do not apply in the event of intent or deliberate recklessness on the part of Processor's managerial staff.

Article 12 - Final provisions

1. In the event of a conflict between this Agreement and the Main Agreement, this Agreement prevails, but only as far as the processing of personal data is concerned. For all other subjects, including liability, the Main Agreement prevails.
2. Amendments to this Agreement and the annexes are valid only if agreed in writing. Processor may update Annex 1 (Sub-processors) and Annex 2 in accordance with Article 4 paragraph 3 and Article 5.
3. If a provision is void or voidable, the remaining provisions remain in force. The Parties then replace the provision with a valid provision that comes as close as possible to the intention.
4. This Agreement is governed by Dutch law. Disputes are submitted to the competent court of the District Court of Midden-Nederland.
5. This Agreement has been drawn up in Dutch and English. In case of discrepancy between the two versions, the Dutch version prevails.

Signature (only if the Parties sign this Agreement separately):

Annex 1 - Specification of the processing

Annex 2 - Technical and organisational measures

1. Access: least privilege; separate accounts per customer where possible; multi-factor authentication (phishing-resistant where possible) on all business accounts; access is revoked upon completion of the assignment.
2. Endpoints: devices are centrally managed (mobile device management), with full disk encryption, passcode and automatic screen lock, up-to-date patches and endpoint protection.
3. Encryption: TLS for data in transit; encryption at rest in the cloud services used.
4. Data minimisation: personal data are, where possible, processed in Controller's environment and not copied to Processor's own systems; test data is anonymised where possible. Personal data are not entered into external services that are not approved Sub-processors, such as AI services and online tools, unless they have first been pseudonymised or aggregated.
5. Secrets and keys: stored in a password manager or key vault, never in code or documentation.
6. Logging and monitoring: relevant security logging and alerting on the business environment.
7. Incident response: Personal Data Breaches are assessed and notified in accordance with Article 7.
8. Personnel and third parties: confidentiality obligation for everyone working on behalf of Processor; Sub-processors in accordance with Article 5.
9. Back-up and deletion: back-ups of own business data; secure deletion upon completion in accordance with Article 10.