Data processing agreement

1. Parties and subject

This agreement is between you as the client (controller) and Rene IJnema (processor). I only process personal data to deliver the services you ordered: hosting, VPS, email, WordPress and WooCommerce maintenance, development and help on credit.

2. Which data and whose

That depends on what you keep on your site and in your mail. Usually it is:

• Customers and visitors of your site: name, address, email, phone, orders, IP addresses in log files
• Users and accounts of your WordPress or WooCommerce
• Contents of email in mailboxes I host
• Submitted forms and comments on your site

3. Only on your instructions

I only use the data for the service and according to your instructions. I do not view, copy or share it for other purposes, and never sell it. I only look at it when the work needs it, for example to fix a problem with an order.

I am the only person with access. I keep the data confidential, also after this agreement ends.

4. Security

I take appropriate technical and organisational measures, including:

• Servers in data centres inside the European Union
• Encrypted connections (SSL/TLS) for sites, admin and email
• A firewall, malware scanning and brute force protection
• Signing in with keys or one-time codes, no shared passwords
• Daily backups, also in a second location, regularly restored as a test
• Software and systems I update as soon as security updates appear

5. Sub-processors

For part of the work I use fixed suppliers: the data centre where the servers are (in the EU), the domain name registrar, and where needed a service for sending email. They are bound by terms at least as strict as these. I send you a current list on request, and tell you in advance when a new one is added, so you can object.

Data does not go to countries outside the European Economic Area, unless you choose that yourself (for example with a non-EU service you use on your site).

6. Data breaches

If I discover a security incident that may involve personal data, I tell you without undue delay and within 48 hours at the latest. I explain what happened, which data is involved, what I did to stop it and what you may need to do. Whether the incident must be reported to the supervisory authority or to the people involved is your decision; I help you with it.

7. Rights of data subjects and help

If someone asks you for access to, correction or deletion of their data, I help you where needed. A request that reaches me directly I forward to you. I also cooperate with a data protection impact assessment (DPIA) or a question from the supervisory authority. If that takes more than a few minutes, I use credit for it, after checking with you.

8. Audits

You may check that I keep to these terms. I give you the information you need for that. If you want an audit carried out, we agree the approach and costs in advance.

9. End of the service

When a service ends, you can get a full copy of your site, database and email for up to 30 days afterwards. After that I delete the data, also from the backups as soon as they expire under their retention period, unless the law requires me to keep something longer.

10. Liability and term

Liability is as set out in the terms and conditions. This agreement runs for as long as I process personal data for you. Dutch law applies to this agreement.

Questions, or need a signed copy? Email mail@reneijnema.nl.