Processor Agreement

Parties:

The private company Payt B.V., hereinafter referred to as ‘Processor’;

in

Customer of Payt B.V., hereinafter referred to as ‘Controller’;

Hereinafter collectively referred to as ‘Parties’ and individually as ‘Party’.

Whereas:

• The Processor has developed an online platform for debtor management and collection services;
• The Controller uses or intends to use the Processor’s services;
• This usage entails the Processor processing or intending to process Personal Data on behalf of the Controller;
• The Controller and the Processor aim to document their mutual rights, obligations, and agreements concerning the Processing of Personal Data in relation to these services in this Processing Agreement.
• The following Appendices are an integral part of this Processing Agreement:
• • APPENDIX 1: Personal Data; individuals concerned, subject and duration, nature and purpose, method and means of processing;
  • APPENDIX 2: Security Measures.
• Should any provision of an Appendix be incompatible or conflict with a provision of the Processing Agreement, the provisions of the Appendix will take precedence.

Within this Processing Agreement, the following terms, identified by an initial capital letter and applicable in both their singular and plural forms, are defined as follows:

• Data Subject: the individual to whom the personal data pertains or their designated representative.

  Processor: the party that processes Personal Data on the Controller’s behalf, without falling under the Controller’s direct supervision. In the context of this Processing Agreement, this is Payt B.V.

  Appendix: a component of the Processing Agreement providing further clarification and information on a specific aspect or component of the services.

  Personal Data: any data concerning an identified or identifiable individual.

  Controller: the individual, legal entity, or any other body or administrative unit that, alone or together with others, defines the objectives and means of processing Personal Data.

  Processing: any action or series of actions conducted on Personal Data, encompassing, but not limited to, gathering, documenting, organizing, storing, updating, altering, retrieving, consulting, employing, sharing via transmission, spreading or otherwise making available, amalgamating, associating, as well as blocking, deleting, or annihilating Personal Data.

1. The Processor shall process Personal Data on behalf of the Controller, with the Controller supplying Personal Data to the Processor for this purpose.

   The Processor shall process Personal Data solely in accordance with the Controller’s written instructions (as specified in this Processing Agreement and the service agreement entered into between the Controller and the Processor, to which this Processing Agreement is annexed), unless legally required to process the Personal Data. In such cases, the Processor will notify the Controller of this legal requirement prior to processing, except where the law prohibits such notification on significant grounds of public interest.

   Should the Processor consider that an instruction from the Controller violates data protection legislation, including the General Data Protection Regulation (GDPR), it shall promptly notify the Controller.

   The Controller has defined the purposes for processing Personal Data and has communicated these purposes to the Processor.

   The Processor agrees not to process the Personal Data for any purposes other than those specified in Appendix 1.

   The Personal Data processed by the Processor on the Controller’s behalf, regardless of how it is obtained, remains the property of the Controller and/or the relevant Data Subject.

   The Controller assures the Processor that the handling, use, and/or processing of the Personal Data is lawful and does not infringe any third party’s rights, that such Personal Data have been lawfully collected and shared, and indemnifies the Processor against any legal claims by a Third Party arising from the processing of these Personal Data, unless the Controller can demonstrate that the facts underlying the claim are attributable to the Processor.

1. The parties agree that the Processor shall implement suitable technical and organizational security measures, which are commensurate with the current state of technology and the associated costs, relative to the nature of the Personal Data being processed, to safeguard the Personal Data from loss, unauthorized access, alteration, or unlawful processing, as well as to ensure the (timely) availability of the Personal Data.

   The parties acknowledge that security requirements evolve continually, necessitating effective security, frequent assessments, and periodic enhancements of obsolete security measures. Consequently, the Processor will consistently review the security measures in place to protect Personal Data and will, as necessary, strengthen, augment, or refine them to maintain compliance with its obligations.

   Beyond the stipulations of this article, the Processor undertakes the security measures as detailed in Appendix 2.

   The Processor does not warrant that the security measures will be effective under all conditions.

1. Should a breach involving personal data occur within the Processor’s domain, the Processor shall promptly notify the Controller upon discovery.

   The obligation to report shall minimally include the notification of the occurrence of a breach or incident, the (suspected) cause of the breach or incident, the currently known and/or anticipated consequences, and the (suggested) resolution.

   The Controller, should it find it necessary, will notify Data Subjects and other third parties, including the Dutch Data Protection Authority, about a data breach or other incidents. The Processor is not authorized to directly communicate information regarding a data breach or other incidents to Data Subjects or other third parties unless legally required to do so or with express consent from the Controller.

1. The Processor commits to providing full support to the Controller, upon the Controller’s approval and on its behalf, to:

   • Grant data subjects access to their Personal Data and furnish details concerning the processing of their Personal Data;
   • Enable data subjects to obtain their Personal Data in a structured, commonly used, and machine-readable format and to transmit those data to another party;
   • (Temporarily) restrict the processing of Personal Data solely to storage, or to processing for which the Data Subject has granted consent, until the Controller decides to lift the processing restriction;
   • Erase or amend Personal Data of Data Subjects (for instance, if a Data Subject legitimately contests the processing of their Personal Data);
   • Verify that Personal Data have been erased or corrected if they are inaccurate (or, if there is disagreement from the Controller regarding the accuracy of Personal Data, to document the Data Subject’s belief that their Personal Data are incorrect).

   Moreover, upon the Controller’s initial request, the Processor will, as promptly as possible but no later than five working days following the receipt of the request:

   • Provide all necessary written information that the Controller may require;
   • Amend, supplement, delete, or protect Personal Data.

   To the fullest extent possible, the Processor will cooperate fully with the Controller in meeting its obligations under the relevant data protection legislation.

1. Payt is committed to retaining the minimal amount of data that is no longer relevant. Simultaneously, historical data presents opportunities for enhanced insights, financing options, and reference material for annual reports.

   Considering the nature of the service, the retention period commences once an invoice has been settled.

   The Processor adheres to a standard retention period of 25 months.

   Alterations to this standard can be made through the application or via the service desk.

1. Amendments to this Processing Agreement are only binding if agreed upon in writing by the Parties.

   This Processing Agreement supersedes all other agreements between the Controller and the Processor concerning the processing of Personal Data.

   This Processing Agreement is governed exclusively by Dutch law.

   Disputes arising from or related to this Processing Agreement shall be exclusively resolved by the competent court in the Processor’s place of business.

APPENDIX 2 Security measures

The processor takes, among other things, security measures in the following areas, as laid down in its information security policy. Processor has an ISO 27001 certification for its information security policy.

• Safe staff;
• Asset management;
• Access security;
• Cryptography;
• Physical security;
• Security of business operations;
• Communications security;
• Acquisition etc. of systems;
• Supplier relations;
• Management of Information Security Incidents;
• Aspects of business continuity management;
• Compliance.

We are happy to make the declaration of applicability available to you confidentially and upon request.