Data processing agreement

1. Parties and purpose

This data processing agreement (in Dutch: verwerkersovereenkomst) is between the customer who uses Mentiofy (the controller, "you") and Trueqrcode, trading as Mentiofy, KvK 71264558, Nieuwe Gracht 3, 2011 NB Haarlem, the Netherlands (the processor, "we").

It applies whenever we process personal data on your behalf while providing the service under our Terms of service, and it forms part of those terms. It meets the requirements of Article 28 of the General Data Protection Regulation (GDPR). You accept it by accepting the Terms of service. If you need a signed copy, email info@mentiofy.com.

2. Definitions

Terms such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meaning given in the GDPR. Customer personal data means personal data that you or your clients put into the service, or that we process on your behalf while providing it. Sub-processor means a third party we engage to process customer personal data.

3. What we process and why

We process customer personal data only to provide the service: measuring prompts on AI engines, analysing the answers, reporting, support and billing-related communication about your account. Annex 1 describes the processing in more detail.

We process customer personal data for as long as the agreement runs, and after that only as far as needed to return or delete it, see section 11.

4. Your instructions

We only process customer personal data on your documented instructions. The Terms of service, this agreement and the way you configure and use the service are your instructions. If we believe an instruction breaks the GDPR or other data protection law, we tell you straight away. If the law requires us to process data in another way, we tell you first, unless the law forbids it.

You are responsible for having a valid legal basis for the processing, for informing data subjects, and for the data you or your clients put into the service. Please don't put special categories of personal data into the service.

5. Confidentiality

Everyone at Mentiofy, and every sub-processor, who has access to customer personal data is bound by confidentiality, by contract or by law, and only gets access as far as needed for their work.

6. Security

We take appropriate technical and organisational measures to protect customer personal data against loss and unlawful processing, taking into account the state of the art, the costs and the risks. Annex 2 lists these measures. We may update them, as long as the overall level of protection does not go down.

7. Sub-processors

You give us general permission to engage sub-processors. Annex 3 lists the current ones. We impose the same data protection obligations on them as this agreement places on us, and we remain responsible for them towards you.

We tell you at least 30 days before we add or replace a sub-processor, by email or in the app. You can object on reasonable grounds within that period. If we can't solve the objection, you may end the agreement for the affected part of the service, without paying for the remaining period.

8. Transfers outside the EEA

Where customer personal data is transferred outside the European Economic Area, we make sure the transfer meets the GDPR, for example because the recipient is certified under the EU-US Data Privacy Framework, the country has an adequacy decision, or through the European Commission's Standard Contractual Clauses with additional measures where needed.

9. Helping you

Taking into account the nature of the processing, we help you:

• answer requests from data subjects who use their rights, such as access, correction or deletion. If a data subject contacts us directly, we forward the request to you and don't answer it ourselves unless you ask us to;
• meet your obligations on security, data protection impact assessments and prior consultation with the supervisory authority;
• show that you comply with the GDPR.

We may charge reasonable costs for help that goes beyond what the service normally offers. We tell you in advance.

10. Personal data breaches

If we become aware of a personal data breach that affects customer personal data, we tell you without undue delay and in any case within 48 hours. We give you the information you need to assess the breach and, where required, to report it to the supervisory authority and to data subjects within the legal deadline. This includes, as far as known: what happened, which data and how many data subjects are affected, the likely consequences, and the measures we took or propose. We take measures to limit the consequences and to prevent it from happening again.

Reporting a breach to the supervisory authority or to data subjects is your responsibility as controller, unless we agree otherwise.

11. When the agreement ends

When the agreement ends, you can export your data for 30 days. After that we delete customer personal data, including copies, within 90 days, unless the law requires us to keep it. Backups are overwritten in the normal backup cycle. On request, we confirm in writing that the data has been deleted.

12. Audits

We give you the information you need to show that we meet this agreement. You may have an audit done, at most once a year, by an independent auditor bound by confidentiality, with at least 30 days' notice and during normal working hours. You pay the costs of the audit, unless it shows that we seriously broke this agreement. If we have a recent independent report or certification that covers the questions, we may give you that instead.

13. Liability

The limits of liability in the Terms of service apply to this agreement as well. Each party remains liable for fines imposed on it by a supervisory authority, as far as the GDPR provides.

14. Duration and changes

This agreement runs as long as we process customer personal data for you. Obligations that by their nature continue, such as confidentiality and deletion, keep applying after it ends. We may change this agreement when the law or our service changes, in the same way as described for the Terms of service. If this agreement and the Terms of service conflict on data protection, this agreement prevails.

15. Law and disputes

Dutch law applies. Disputes go to the competent court in the district of Noord-Holland, location Haarlem. This agreement is written in English, and the English version always prevails over any translation.

16. Annex 1: Description of the processing

17. Annex 2: Security measures

• All connections are encrypted with TLS.
• Data is stored with a hosting provider that meets recognised security standards, protected against attacks by Cloudflare.
• Access to customer personal data is limited to people who need it, with two-factor authentication on admin access.
• Passwords are stored as salted hashes, never in plain text.
• Regular backups, with a tested restore procedure.
• Logging of access to sensitive data and monitoring for unusual activity.
• We only send AI providers the data needed for each task, under business terms that keep it out of model training where the provider offers this.
• A procedure for handling and reporting personal data breaches.
• Regular review of these measures.

18. Annex 3: Sub-processors