Verwerkersovereenkomst
Effective date: 2026-09-05 Version: 1.1.0
This document forms part of the Astalias global legal framework. Astalias is an international software and digital-services platform and is not presented as being directed exclusively to any single country. Mandatory rights and obligations that cannot lawfully be excluded or restricted remain unaffected.
1. Parties and application
This Data Processing Agreement (“DPA”) forms part of the agreement between a business customer (“Customer”) and Niet geconfigureerd (“Astalias”) only to the extent Astalias processes personal data on behalf of Customer as a processor, service provider or equivalent role in providing an eligible Service. It does not apply to processing for which Astalias independently determines the purposes and means, such as account administration, billing, fraud prevention or Astalias’s own legal compliance.
2. Definitions
“Customer Personal Data” means personal data processed by Astalias on behalf of Customer under the Services. “Data Protection Law” means privacy or data-protection law applicable to the relevant processing. “Subprocessor” means a third party engaged by Astalias to process Customer Personal Data on behalf of Customer.
3. Details of processing
Subject matter: provision, support, security and operation of the eligible Astalias Service.
Duration: for the term of the Service and any limited period necessary for deletion, return, backup rotation, security, legal retention or dispute handling.
Nature and purpose: hosting, storage, transmission, retrieval, organisation, support, troubleshooting, security, connector operation and other processing necessary to provide the Service according to Customer’s configuration and instructions.
Categories of data subjects: Customer personnel, users, customers, website visitors, contacts, directory users, message participants or other individuals whose data Customer lawfully submits to the Service.
Types of personal data: account/contact data, identifiers, communications, content, transaction-related data, technical metadata, device/network data and other categories Customer chooses to submit, subject to product capabilities.
Customer must not use a Service to process special-category, highly sensitive, regulated or high-risk data unless the Service and a separate written agreement expressly support that processing.
4. Customer instructions
Astalias will process Customer Personal Data only on Customer’s documented instructions, including instructions reflected in the applicable agreement, product configuration, API requests and authorised support requests, unless Astalias is required to process the data by law. Where legally permitted, Astalias will inform Customer before processing required by such law.
If Astalias reasonably believes an instruction infringes applicable Data Protection Law, Astalias may inform Customer and suspend the affected processing while the parties address the issue.
5. Customer responsibilities
Customer is responsible for the lawfulness, accuracy and quality of Customer Personal Data; required notices and consents; responding to data subjects as controller; configuring access controls; and ensuring its instructions comply with law. Customer will not instruct Astalias to process data for an unlawful purpose.
6. Confidentiality
Astalias will ensure that personnel authorised to process Customer Personal Data are subject to appropriate confidentiality obligations and receive access only as reasonably necessary for their responsibilities.
7. Security measures
Taking into account the state of the art, implementation costs, nature/scope/context/purpose of processing and risks to individuals, Astalias will maintain technical and organisational measures reasonably designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include identity/access management, least privilege, encryption in transit, secrets management, logging/monitoring, backup controls, vulnerability/patch management and incident response appropriate to the Service.
8. Subprocessors
Customer grants Astalias general authorisation to engage Subprocessors necessary to provide the Service. Astalias will impose data-protection obligations on Subprocessors appropriate to their processing and will remain responsible for Subprocessor performance to the extent required by applicable law. Current providers or categories are described in the Subprocessor List.
Where Data Protection Law requires notice of new Subprocessors and an opportunity to object, Astalias may provide notice by updating the Subprocessor List, account notice or another reasonable method. An objection must be based on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable solution; if none is available, either party may terminate the affected Service to the extent necessary.
9. Data-subject requests
Taking into account the nature of the processing, Astalias will provide reasonable assistance through technical functionality or support so Customer can respond to requests to exercise privacy rights. If Astalias receives a request relating primarily to Customer-controlled data, Astalias may direct the requester to Customer unless law requires Astalias to respond differently.
10. Security incidents
Astalias will notify Customer without undue delay after becoming aware of a confirmed personal-data breach affecting Customer Personal Data where notification is required by applicable law. Notice will provide information reasonably available to Astalias about the nature of the incident, affected data, likely consequences and measures taken or proposed. Notification is not an admission of fault or liability.
11. DPIAs, consultations and compliance assistance
Taking into account the nature of processing and information available, Astalias will provide reasonable information and assistance for data-protection impact assessments, prior consultations or regulator inquiries where required by law and directly related to Customer’s use of the Service. Extraordinary assistance may be subject to reasonable fees if permitted by the commercial agreement and law.
12. International transfers
Customer authorises international processing necessary to provide the Service, subject to lawful transfer requirements. Where Data Protection Law requires a recognised transfer mechanism, the parties will use an available mechanism appropriate to their roles, such as adequacy decisions or applicable standard contractual clauses. If execution of a specific transfer addendum is legally necessary, the parties will cooperate in good faith.
13. Return and deletion
Upon termination of the affected Service, Astalias will delete or make available for return Customer Personal Data in accordance with product functionality and the agreement, unless law requires retention. Data may remain temporarily in backups or security archives until overwritten under normal lifecycle controls, provided it remains protected and is not restored for ordinary business use except as necessary for recovery.
14. Information and audits
Astalias will make available information reasonably necessary to demonstrate compliance with applicable processor obligations. Where Data Protection Law grants Customer an audit right, the parties will first use available documentation, certifications, questionnaires or independent reports where sufficient. On-site audits, if legally required and not otherwise satisfied, must be reasonable, proportionate, protect other customers and confidential information, avoid unnecessary disruption and normally occur no more than once annually unless a confirmed incident or regulator requires otherwise.
15. Priority and liability
If this DPA conflicts with the main agreement on processing of Customer Personal Data, this DPA controls for that subject. Liability under this DPA is subject to the liability framework in the main agreement to the maximum extent permitted by applicable law, except where law requires otherwise.
16. Contact
Privacy and DPA communications may be sent to trend@barooc.com.