With its registered office at Maanlander 47 3824 MN Amersfoort, the Netherlands Registered with the chamber of commerce under number 58953825
CHAPTER 1. GENERAL 3
Article 1. Definitions 3
Article 2. Applicability 4
Article 3. Proposals and Offers 4
Article 4. Duration of the Agreement 5
Article 5. Delivery Period and Lead Time 5
Article 6. Delivery of Items 5
Article 7. Risk and Insurance 5
Article 8. Retention of Title 6
Article 9. Cooperation by Client 6
Article 10. Intellectual and Industrial Property Rights 7
Article 11. Confidential Data and Privacy 8
Article 12. Prohibition on Transfer of Staff 8
Article 13. Invoicing and Payment 9
Article 14. Price Changes 9
Article 15. Liability of SC Business Application Development BV; Indemnification 9
Article 16. Force Majeure 10
Article 17. Termination 10
Article 18. Applicable law, Interpretation of the Terms and Disputes 10
CHAPTER 2. USE AND MAINTENANCE OF SOFTWARE AND SAAS 12
Article 19. Right of Use 12
Article 20. Delivery, Installation and Acceptance 12
Article 21. Error Repair 13
Article 22. Maintenance and Updates 14
Article 23. Software of Suppliers 14
Article 24. Access to the SaaS 15
CHAPTER 3. DATA PRO STATEMENT 16
Article 25. General Information 16
Article 26. Description of the Services 16
Article 27. Collecting and Processing Data 16
Article 28. Sub-Processors 16
Article 29. Data Subject Rights 17
Article 30. Security Policy 17
Article 31. Data Breach Protocol 18
CHAPTER 4. STANDARD CLAUSES FOR DATA PROCESSING 19
Article 32. Definitions 19
Article 33. General Provisions 19
Article 34. Security 20
Article 35. Data Breaches 20
Article 36. Confidentiality 20
Article 37. Term and Termination 21
Article 38. The Rights of Data Subjects, Data Protection Impact Assessments (DPIA) and Auditing Rights 21
Article 39. Sub-Processors 22
Article 40. Other Provisions 22
The provisions under this chapter ‘General’ apply to all Agreements to which SC Business Application Development BV, also operating under the name Incrowd (Pro), is a Party, with the exception of any deviations made in other chapters, in which case the provisions of these specific chapters shall prevail over the provisions in the chapter ‘General’.
Article 1. Definitions
Unless the context of a term specifically indicates otherwise, the terms used in these General Terms and Conditions are defined as follows:
General Terms and Conditions: the provisions in the present document.
Loan Agreement: The Agreement effected between SC Business Application Development BV and the Client based on which SC Business Application Development BV will provide Client with an Item without financial consideration being due, on condition that the Item will be returned to SC Business Application Development BV after the expiry of the agreed on loan period.
Data: digital information and details, including but not limited to text, documents, images, audio and video files, (source) files, scripts and other software.
Service(s): the Service(s) to be delivered or performed by SC Business Application Development BV for the Client, including but not limited to the delivery of or access to software applications and affiliated activities as described in the offer by and/or Agreement with SC Business Application Development BV.
Commencement date: the date on which the Agreement becomes effective and the delivery of the Service(s) commences.
Item: any Item, including those delivered subject to any retention (of title), provided or given on loan, based on the Agreement between SC Business Application Development BV and the Client.
Client: the natural or legal entity with whom SC Business Application Development BV has entered into an Agreement and other Party to the Agreement with SC Business Application Development BV for the purposes of article 6:231 under c Dutch Civil Code. This shall also include any person entering into or involved in negotiations to that end, as well as Service representative(s), authorized representative(s), successor(s) in title or heirs.
Agreement: any Agreement between SC Business Application Development BV and Client resulting from a proposal or offer made by SC Business Application Development BV and its valid acceptance by Client.
Parties: SC Business Application Development BV and the Client jointly;
Price list: the separate list of prices for activities of SC Business Application Development BV and deliverable Services by SC Business Application Development BV as stated in the offer or the proposal.
Software: the software designed and/or developed by SC Business Application Development BV, whether or not at the instruction of the Client, for which SC Business Application Development BV and the Client have entered into an (user) Agreement.
SaaS: the Software as a Service offered by SC Business Application Development BV through its website or in any other way.
In Writing: for the purpose of these General Terms and Conditions, “In Writing” and “written” shall include any communication by email and digital (for instance through an online interface) provided that the identity of the sender and integrity of the contents can be sufficiently established.
SC Business Application Development BV: the other Party to the Agreement with Client and the user of these General Terms and Conditions for the purpose of article 6:231 under b Dutch Civil Code.
SLA: the separate Service Level Agreement effected between SC Business Application Development BV and the Client whichcontains the arrangements on the level, the quality and the method of troubleshooting with regard to the Service.
Working days: Monday through Friday, with the exception of Dutch national holidays, including May 5th every five (5) years.
Work(s): the websites, applications, lay-out, Data files, software, documentation, advice, reports, analyses, designs or other creations developed or designed by SC Business Application Development BV for the benefit of and at the instruction of the Client.
Working hours: hours between 08:30 and 17:00 on Working days.
Article 2. Applicability
These General Terms and Conditions apply to all Agreements to which SC Business Application Development BV is a Party.
The applicability of any general terms and conditions, under any name, on the side of Client is explicitly rejected. Deviations of and additions to these terms shall only be valid if and to the extent that these were accepted by SC Business Application Development BV explicitly and In Writing.
Should SC Business Application Development BV (tacitly) allow deviations from these General Terms and Conditions during a short or longer period of time, these deviations do not impair its right to claim immediate and strict observance of these terms. The Client cannot derive any rights from the method with which SC Business Application Development BV applies the present terms.
These General Terms and Conditions also apply to all Agreements to which SC Business Application Development BV is a Party for the performance of which third Parties are involved. These third Parties can directly appeal to Client for the observance of these terms, such including any limitations of liability.
Should one or more provisions in these General Terms and Conditions be fully or partially void or voidable at any time, all other provisions in these General Terms and Conditions shall remain fully in effect. SC Business Application Development BV shall then replace the void or voidable provision with a new provision permissible by law that takes account of the purpose and scope of the original provision.
In the event of contravention between the contents of an Agreement effected between the Client and SC Business Application Development BV and the present terms, the content of the Agreement shall prevail.
SC Business Application Development BV is entitled to change these General Terms and Conditions at all times. SC Business Application Development BV shall inform the Client, In Writing, no later than thirty (30) days before the effectuation of the changes.
Article 3. Proposals and Offers
All proposals and offers made by SC Business Application Development BV are revocable and will without obligation, unless otherwise indicated In Writing.
All prices and fees of SC Business Application Development BV are listed in the applicable Price list. All amounts are exclusive of turnover tax (VAT) and other government levies of any kind.
A combined quotation does not oblige SC Business Application Development BV to perform part of the assignment or service for a corresponding proportion of the quoted price. Proposals or offers do not automatically apply to future orders and Services.
The contents of the Agreement are exclusively defined by the description of the assignment as stated in the proposal or the offer. Should the acceptance differ (albeit on minor Items) from the contents of the offer or the proposal, SC Business Application Development BV shall not be bound by this. The Agreement shall not be concluded in accordance with such a deviating acceptance, unless SC Business Application Development BV indicates otherwise.
Should an Agreement be offered (partly) based on subsequent calculation of actual costs, the offered prices shall merely serve as a guide price, the actual hours performed by SC Business Application Development BV, as well as the actual costs incurred by SC Business Application Development BV shall be passed on.
Obvious errors or typos in the proposals or/and offers made by SC Business Application Development BV shall not bind SC Business Application Development BV.
The Client guarantees the correctness and completeness of the requirements, specifications and other information and details it provides to SC Business Application Development BV itself or which are provided on its behalf, and on which SC Business Application Development BV bases its proposal.
SC Business Application Development BV is entitled to charge the costs related to the proposal or offer to the Client, provided it has notified the Client of these costs beforehand and In Writing.
The Agreement between Client and SC Business Application Development BV is effected when SC Business Application Development BV sends the Client a confirmation of assignment or commences the actual performance of the Services.
Article 4. Duration of the Agreement
The Agreement shall be entered into for the duration as listed in the Agreement. The Agreement will then be automatically extended for the same duration, without notice, unless a different duration arises from the Agreement. Should no duration be agreed on in the Agreement, the Agreement is considered to have been entered into for an indefinite period.
The Agreement can only be terminated by the Client In Writing at the end of its fixed term with due observance of a notice period of three (3) months and does not have to include reason or motivation. Notice given by the Client only becomes definitive after being confirmed by SC Business Application Development BV In Writing. A fixed-term Agreement cannot be terminated prematurely.
In the event of a termination or notice all user rights with respect to the Services shall end simultaneously with the end of the Agreement.
Article 5. Delivery Period and Lead Time
All delivery periods and lead times listed by or agreed on with SC Business Application Development BV are determined to the best of its abilities based on the information and details available to SC Business Application Development BV at the time of the effectuation of the Agreement. SC Business Application Development BV endeavors to observe the agreed on timeframes where possible. The mere lapse of a listed or agreed on term does not constitute a default on the side of SC Business Application Development BV. In all events, therefore also where Parties agreed on a final deadline explicitly and In Writing, SC Business Application Development BV shall only be in default after Client has notified it of this default In Writing. SC Business Application Development BV shall not be bound to any final deadlines which cannot be met due to circumstances beyond its control which became apparent after the conclusion of the Agreement. Nor is SC Business Application Development BV bound to any final delivery periods should Parties change the contents or scope of the Agreement (additional work, change of specifications etc.). Should any deadline be in danger of lapsing, SC Business Application Development BV and the Client shall consult with each other without delay.
Article 6. Delivery of Items
Unless otherwise agreed, all deliveries are made ex works or ex warehouse. The Client is obligated to take possession of the purchased Items at the moment these are put at its disposal or handed to it.
Should the Item be delivered to Client by a supplier of SC Business Application Development BV based on a Loan Agreement, the Client shall take possession of the Item on behalf of SC Business Application Development BV and shall keep and use the Item in accordance with the provisions of the Agreement, with SC Business Application Development BV maintaining (provisional) ownership of the Item.
Should the Client refuse the delivery or be negligent in offering the information or instructions necessary for the delivery, the Items intended for delivery shall be stored at the expense and risk of Client. Any and all additional costs arising from the refusal or negligence shall be at the expense of the Client.
Should SC Business Application Development BV require information from the Client for the performance of the Agreement, the delivery period shall commence upon SC Business Application Development BV´s receipt of all necessary.
Depending on the delivery situation on the market, SC Business Application Development BV is entitled to suspend delivery.
SC Business Application Development BV reserves the right to involve third Parties for the performance of (parts of) the assignment, such at the expense of SC Business Application Development BV.
Article 7. Risk and Insurance
Should SC Business Application Development BV deliver an Item to the Client based on a Loan Agreement, the Client shall bear all risks of damage to the Item, including full or partial loss or decay of the Item, up to the moment the Agreement with SC Business Application Development BV ends or the moment that the Client becomes the legal owner of the Items. The Client is obligated to reimburse to SC Business Application Development BV any damage to the Item that emerged during the term of the Agreement.
Should the Client be obligated to insure the Item pursuant to the Agreement, the Client shall insure the Item at its own expense and to the satisfaction of SC Business Application Development BV for the duration of the Agreement. The Client shall make sure that the policy includes a so-called “loan clause”. Client shall provide a copy of the policy to SC Business Application Development BV as well as a proof of payment, immediately on request.
The Client shall fully and timely comply with all conditions of the insurance policy.
Article 8. Retention of Title
All Items delivered by SC Business Application Development BV shall remain property of SC Business Application Development BV until the Client has fulfilled all its payment obligations towards SC Business Application Development BV arising from any Agreement for the delivery of Items and/or the performance of activities and/or Services with SC Business Application Development BV, including claims arising from a failure in the performance of the Agreement.
A Client that acts as reseller shall be allowed to sell and resell all Items subject to the retention of title held by SC Business Application Development BV, such to the extent this is common practice in its regular business operations.
Should the Client form a new Item (partly) composed of Items delivered by SC Business Application Development BV, said new Item shall only be formed for the benefit of SC Business Application Development BV and the Client shall hold the new Item on behalf of SC Business Application Development BV until the Client has paid all amounts it owes to SC Business Application Development BV under the Agreement; in other words, SC Business Application Development BV retains all ownership rights of the new Item until the moment that Client has fulfilled all its obligations.
Any rights are at all times granted or transferred to Client on the provision that the Client fully and timely pays the agreed on compensation related to these rights.
Client shall not be permitted to establish any limited rights to Items subject to the retention of title held by SC Business Application Development BV. Should any third Parties (wish to) establish any (limited) rights on the Items subject to the retention of title, the Client will promptly inform SC Business Application Development BV of this intention.
Any delivered Items which were passed to the Client upon payment but are still held by SC Business Application Development BV are subject to a non-possessory pledge as additional security for payment of any claims, other than those referred to in article 3:92 paragraph 2 Dutch Civil Code, SC Business Application Development BV may have towards Client.
The Client is (or others on its behalf are) obligated to keep the Items subject to the retention of title separate from other Items, handle them with due care and mark them as property of SC Business Application Development BV.
The Client is obligated to insure the Items subject to the retention of title against fire, explosion damage and water damage as well as against theft and to provide the policy of these insurances to SC Business Application Development BV for inspection immediately on request. All claims in relation to the aforementioned that the Client may have on the insurers of the Items, shall be silently pledged to SC Business Application Development BV at SC Business Application Development BV’s request, as additional security for payment of any claims SC Business Application Development BV has towards the Client.
The Client guarantees appropriate use and supervision of the Item and shall only apply the Item in accordance with its purpose, the applicable user manuals an any applicable government regulations.
The Client is not permitted to make any physical change, adjustment, repairs or addition to, on or in the Item (or have others do so on its behalf ) without prior written consent of SC Business Application Development BV to that effect.
Article 9. Cooperation by Client
Client shall provide SC Business Application Development BV with all useful and necessary information required for the proper performance of the Agreement and shall fully cooperate with SC Business Application Development BV, which includes allowing access to its buildings. Should the cooperation of Client with the performance of the Agreement entail the application of Client’s own employees, these employees shall have the necessary knowledge, experience, capacities and qualities.
Client carries the risk of the selection, the use and the application of the hardware, Software and/or SaaS, Data files and other products and materials and any Services to be provided by SC Business Application Development BV in its organization, and shall also be responsible for the audit and security procedures and an adequate system administration.
Should the Client provide SC Business Application Development BV with Software and/or SaaS, materials, Data files or Data on an information carrier, these shall comply with the specifications as required by SC Business Application Development BV.
Should the Client not, not timely or not fully provide the information, details, hardware, Software and/or SaaS or employees necessary for the performance of the Agreement, or should the Client fail in any other of its obligations, SC Business Application Development BV shall be entitled to fully or partly suspend the performance of the Agreement and shall be entitled to compensation of any subsequent costs, such in accordance with its customary rates and without prejudice to SC Business Application Development BV’s other legal rights.
In the event that employees of SC Business Application Development BV perform any activities for Client on site, the Client shall provide any reasonable facilities required by the employees, such as a workplace with computer and telecommunication
facilities. The workplace and facilities shall be in compliance with all (statutory) requirements and regulations regarding working conditions. The Client indemnifies SC Business Application Development BV against any claims of third Parties, including employees of SC Business Application Development BV, who suffer damage in connection with the performance of the Agreement arising from the actions or negligence of the Client or any unsafe situations in the organization of the Client. The Client shall make the company rules and security rules currently in force in its organization known to any employees of SC Business Application Development BV who will be working there.
Should the performance of the Agreement require the use of telecommunication facilities, including internet, the Client shall be responsible for the correct choice and the timely and adequate availability, with the exception of any facilities directly used and administered by SC Business Application Development BV. SC Business Application Development BV shall never be liable for any damages or costs arising from transmission errors, interruptions or these facilities being unavailable, unless Client can prove that these damages or costs are the result of intent or gross negligence of the part of SC Business Application Development BV or its management. Should with the performance of the Agreement require the use of telecommunication facilities, SC Business Application Development BV shall be entitled to provide the Client with access and identification codes. SC Business Application Development BV may change the assigned access and identification codes. The Client shall handle the access codes with confidentiality and care and shall only disclose these codes to authorized personnel. SC Business Application Development BV shall never be liable for damage or costs arising from the abuse of access or identification codes.
Article 10. Intellectual and Industrial Property Rights
All intellectual and industrial property rights in relation to the Software and/or SaaS, Data files, hardware or other materials including analyses, designs, documentation, reports, course materials, offers, as well any preparatory material, developed or provided pursuant to the Agreement, shall be exclusively held by SC Business Application Development BV, its licensors or its suppliers. The Client shall only obtain the user rights which it is explicitly granted in these terms and by law. Any other or further right of the Client to reproduce, publish or use of Software and/or SaaS, Data files or other materials is excluded. Any user right accruing to the Client is non-exclusive and non-transferable to any third Parties.
The Client is not permitted to remove or change any indication with regard to the confidential nature of the Item, or copyright, brands, trade names or other rights from the Software and/or the SaaS, the Data files hardware of any other materials.
SC Business Application Development BV may take technical measures to protect the Software and/or SaaS or the agreed on limitations in the scope of the user rights of the Software and/or SaaS. The Client is not permitted to remove or avoid such a measure.
The risk of involuntary loss of possession or damage of the Software is transferred to the Client upon delivery. It will then be up to the Client to insure said risk and/or make an adequate and full back-up copy.
With due observance of the other provisions of these General Terms and Conditions, the Client shall be entitled to correct errors in the provided Software and/or SaaS to the extent that this is necessary for the intended use of the Software and/or SaaS. In these General Terms and Conditions, ‘errors’ are defined as the substantial noncompliance with the functional and technical specifications and, in the case of custom software or a custom SaaS, the functional or technical specifications agreed on between Parties In Writing. An error can only be classified as such when it can be proven by the Client and is reproducible. The Client is obligated to inform SC Business Application Development BV of any errors immediately.
SC Business Application Development BV indemnifies the Client against any legal claims made by third Parties which are based on the assertion that the Software and/or SaaS, Data files, hardware or other materials developed by SC Business Application Development BV itself infringe on a right of intellectual or industrial property valid in the Netherlands, on the condition that Client promptly informs SC Business Application Development BV of the existence and the contents of the legal claim and fully leaves the handling of the case, including any settlements, to SC Business Application Development BV. Client shall provide the necessary authorizations, information and cooperation to SC Business Application Development BV so that it can defend itself, where necessary in name of the Client, to these legal claims. This obligation of indemnification lapses when the alleged infringement is connected to (i) materials given in use, for processing or incorporation to SC Business Application Development BV by the Client, or (ii) changes to the Software and/or SaaS, Data files, hardware or other materials made by the Client or by third Parties on behalf of the Client. In the event that it is judicially and irrevocably established that the Software and/or SaaS, Data files, hardware or other materials developed by SC Business Application Development BV itself infringe any third Party intellectual or industrial property right or should SC Business Application Development BV be of the opinion that there is a good chance that such an infringement may occur, SC Business Application Development BV’s liability is
limited as follows: SC Business Application Development BV shall make every effort to allow the Client’s undisrupted use of the delivered Item, or functionally similar other Software and/or SaaS, Data files, hardware or any other relevant materials, for instance by making adjustments to the infringing parts or by acquiring a user right for the Client. When in SC Business Application Development BV’s sole opinion the undisrupted use of the delivered Item by Client cannot continue or can only be made under financially unreasonable circumstances, SC Business Application Development BV shall credit Client with the acquisition costs to be deducted by a reasonable a usage fee. SC Business Application Development BV shall consult with the Client before deciding on the way this will be done. Any other or further liability or obligation to indemnify on the part of SC Business Application Development BV as a result of a breach of intellectual or industrial property rights of a third Party is fully excluded, including liability and obligations to indemnify of SC Business Application Development BV for infringements caused by the use of the delivered Software and/or SaaS, Data files, hardware and/or materials (i) in a form modified by SC Business Application Development BV, (ii) in conjunction with any Items or Software and/or SaaS not delivered or provided by SC Business Application Development BV or (iii) any other use than the use for the which the hardware, Software and/or SaaS, Data files and/or other materials were developed or intended.
The Client guarantees that no third Party rights preclude it from making hardware, Software and/or SaaS, Data files, or other materials including visual materials, text, music, domain names, logos, design material, etc. available to SC Business Application Development BV with the aim of use, operation, installation or incorporation (e.g. on a website). Client shall indemnify SC Business Application Development BV against any legal claim based on the assertion that the provision, use, modification, installation or incorporation infringes any third Party rights.
Article 11. Confidential Data and Privacy
The Client shall inform SC Business Application Development BV fully and In Writing of the way in which the Client executes its obligations under the laws of processing and securing personal Data. The Client is responsible for the compliance with the obligations under the laws of processing and securing of personal Data. SC Business Application Development BV shall be considered a processor of personal Data for the purposes of the General Data Protection Regulation (GDPR). SC Business Application Development BV shall inform the Client of its procedures concerning the processing of personal Data through these general terms.
The Client indemnifies SC Business Application Development BV against any claims of persons whose personal Data is registered or processed for the purposes of registration of personal Data held by the Client or for which the Client is responsible under the provisions of the law.
The full responsibility for the Data that is processed by the Client through a Service of SC Business Application Development BV lies with the Client. The Client guarantees towards SC Business Application Development BV that the contents, the use and/or the processing of the Data shall not be unlawful and shall not infringe any third Party rights. The Client indemnifies SC Business Application Development BV against any and all legal claims by third Parties in connection with this Data or the performance of the Agreement.
The Client indemnifies SC Business Application Development BV for any claims of persons whose personal Data is registered or processed for the purposes of registration of personal Data held by the Client or for which the Client is responsible under the provisions of the law, unless the Client proves the facts on which the claim is based are fully attributable to SC Business Application Development BV.
Article 12. Prohibition on Transfer of Staff
Each of the Parties shall refrain from having employees of the other Party work for them or in any other way engaging them, whether directly or indirectly, during the term of the Agreement as well as for a period of one (1) year after the termination of the Agreement unless it obtains prior written permission from the other Party. SC Business Application Development BV shall not withhold this permission if the Client offers a suitable compensation in a particular case.
Should the Client not comply with the provisions in paragraph 1 of this article, the Client owes to SC Business Application Development BV an immediately payable compensation, not subject to judicial mitigation, of two times the gross annual salary of said employee, based on a 40 hour Work week and to be increased with all applicable allowances, bonuses, holiday allowances and thirteenth month's salary.
Article 13. Invoicing and Payment
Invoices shall be paid by the Client in accordance with the payment conditions stated on the invoice. Should specific conditions not be given, the Client shall pay the invoice within thirty (30) days of the invoice date. The Client is not entitled to a set off or suspension of payment.
Should the Client not pay the invoice within the agreed on payment term, the Client shall be in default by operation of law without further notice of default being required.
From the moment of default, the Client owes a contractual interest of 1% per month on the amount it owes, unless the statutory commercial interest rate is higher, in which case the statutory commercial interest rate applies. All (extra) judicial costs incurred by SC Business Application Development BV in the process of obtaining payment, at law and otherwise, shall then be at the expense of the Client. In that event, the Client owes a compensation of at least 15% of the amount due, with a minimum of € 250.00. Any actual costs (to be) incurred by SC Business Application Development BV which exceed this amount also qualify for compensation.
Should the Client not timely fulfil its payment obligations, SC Business Application Development BV shall be entitled to suspend the delivery of the Items and Services or to suspend or limit the performance of the activities until payment has been made or adequate security is provided. The same applies should SC Business Application Development BV have reasonable grounds to suspect that the Client’s creditworthiness is uncertain, even before the moment of default.
In the event of (an application for) liquidation, bankruptcy, restructuring or suspension of payment at the side of the Client, any claims or obligations the Client has towards SC Business Application Development BV become immediately due and payable.
Should the Client have any counter claims against SC Business Application Development BV, of any nature, the Client waves its right to setoff these claims. The aforementioned abandonment of the right of setoff also applies when the Client applies for a (provisional) suspension of payment or is declared bankrupt.
The Client is not entitled to set off any claims SC Business Application Development BV has on Client with any counter claims it has on SC Business Application Development BV. This also applies when the Client applies for a (provisional) suspension of payment or is declared bankrupt.
Article 14. Price Changes
In the event of a periodical payment obligation on the side of the Client, SC Business Application Development BV shall be entitled to change its price and rates by notification In Writing, taking into account a notice period of at least 1 (in words: one) month. Should Client not agree to such a change, Client must inform SC Business Application Development BV within this month and Parties shall consult with each other further.
Article 15. Liability of SC Business Application Development BV; Indemnification
The total liability of SC Business Application Development BV towards Client as a result of an attributable failure in the fulfilment of an Agreement is limited to compensation of direct damage for a maximum of the invoice amount (excluding VAT). If the Agreement is primarily a continuing performance contract with term of more than one (1) year, the stipulated price for the Agreement shall be set on as the sum of the fees charged (excluding VAT) for one (1) year. Direct damages shall exclusively mean:
reasonable costs which Client would have to incur to have SC Business Application Development BV’s performance comply with the Agreement; this substitute damage shall not be compensated when the Agreement is terminated by or at the request of the Client;
reasonable costs incurred for the determination of the cause and the scope of the damage, to the extent that the determination relates to the direct damage for the purposes of these terms;
reasonable costs incurred to prevent or limit the damage, to the extent that Client can prove that these costs have lead to a limitation of direct damage as intended in these terms.
Liability on the part of SC Business Application Development BV for indirect damage, consequential damage, lost profit, lost savings, decreased goodwill, loss due to business interruption, damage resulting from claims by customers of Client, corruption or loss of Data, damage in connection with the use of Items prescribed by Client to SC Business Application Development BV, materials or software of third Parties, damage in connection with the involvement of suppliers as instructed to SC Business Application Development BV
by Client and all other forms of damage other than those listed in paragraph 1 of this article, of any nature, is excluded.
The limitations stated in the previous article shall lapse when and to the extent that the damage is the result of intent or gross negligence on the part of SC Business Application Development BV or its management.
The liability of SC Business Application Development BV as a result of attributable failure in the performance of an Agreement shall only arise when the Client promptly and adequately notifies SC Business Application Development BV In Writing, such including a reasonable period in which the failure can be remedied, and SC Business Application Development BV remains in attributable default even after the lapse of such a period. The notice of default should contain a description of the failure with as much detail as possible, so that SC Business Application Development BV may react adequately.
Any right to damages is always on the condition that the Client notifies SC Business Application Development BV of said damage without delay and In Writing. Any claim for damages against SC Business Application Development BV lapses by the mere lapse of twelve (12) months after the occurrence of the claim.
The Client indemnifies SC Business Application Development BV against all third Party claims in relation to product liability arising from a defect in a product or system delivered to a third Party by the Client and that consisted partly of hardware, Software and/or SaaS or other materials delivered by SC Business Application Development BV, if and to the extent that the Client proves that the damage was caused by said hardware, Software and/or SaaS.
The provisions in this article also apply to all (legal) persons used by SC Business Application Development BV in the performance of the Agreement.
Article 16. Force Majeure
Neither Party is obligated to fulfil of any of the obligations should it be hindered by force majeure. Force majeure shall include force majeure on the part of suppliers of SC Business Application Development BV, improper performance of obligations by suppliers who Client instructed SC Business Application Development BV to engage, as well as defective Items, materials, Software and/or SaaS of any third Parties the use of which was prescribed to SC Business Application Development BV by Client.
Should a force majeure situation exceed ninety (90) days, Parties shall be entitled to terminate the Agreement by giving notice In Writing. Any performance rendered under the Agreement shall then be paid proportionately, without the Parties having any further liability towards each other.
Article 17. Termination
A Party may only dissolve the Agreement if the other Party fails imputably to perform an essential obligation under the Agreement after an adequate notice of default containing as many details as possible and allowing a reasonable term to remedy the default is given.
Each of the Parties may partly or completely terminate the Agreement In Writing with immediate effect and without a notice of default being due if the other Party is granted a - provisional - moratorium, when a petition of liquidation is filed against the other Party or if the other Party is wound up or terminated for other reasons than for reconstruction or a merger of companies. SC Business Application Development BV can never be held to any restitution of money it has received or to any compensation of damage. In case of Client’s bankruptcy, any rights to use the Software and/or SaaS provided to Client expire by operation of law.
If at the time of a dissolution as referred to in paragraph 1 of this article, the Client has received any performance in the execution of the Agreement, such a performance and its subsequent payment obligation shall not be made undone, unless the Client proves that SC Business Application Development BV is in default with regard to those obligations. Any amounts invoiced by SC Business Application Development BV in relation to an adequate performance or delivery of the Agreement before the dissolution, will remain payable in full with due observance of the previous sentence and will fall due immediately upon termination.
Article 18. Applicable law, Interpretation of the Terms and Disputes
Dutch law shall govern any Agreements between SC Business Application Development BV and the Client;
For the interpretation of these General Terms and Conditions as well as in case of discrepancies between the interpretation of the contents and purport of any translations of these General Terms and Conditions and the English text version, the English text prevails.
Any dispute - including any situations considered to be a dispute by only one of the Parties - which may arise between the Parties pursuant to an Agreement which is fully or partially governed by these terms and conditions or any other Agreements which arise from such an Agreement, shall exclusively be brought before the competent court of law in the district in which SC Business Application Development BV has its registered office, unless otherwise provided by mandatory law. However, SC Business Application Development BV and Client may agree to have the dispute settled by independent arbitration.
In addition to the applicable General Terms and Conditions (Chapter 1. General), the provisions of this chapter “Use and Maintenance of Software and SaaS” shall apply to all Software and SaaS provided by SC Business Application Development BV.
Article 19. Right of Use
Without prejudice to the provisions of article 10, SC Business Application Development BV grants the Client the non-exclusive right to use the Software and/or SaaS. The Client shall strictly observe any restrictions of use agreed on between Parties. Without prejudice to the other provisions of these General terms and conditions, the user right of Client only exclusively entails the right to load and run the Software and/or SaaS, or log on to it and download it to the extent this is necessary for normal use.
The Software and/or SaaS may only be used by Client in its own company or organization and for the agreed on number of users or connections for which a user right is issued. To the extent that no other arrangements were made to that effect, the processing unit of Client on which the Software and/or SaaS was first used and the number of connections connected to the processing unit at this first use, shall serve as processing unit and number of connections for which the user right was issued. In the event of a failure of said processing unit, the Software and/or SaaS may be used on a different processing unit for the duration of the failure?. The user right can relate to multiple processing units to the extent that this is evident from the Agreement.
The user right is not transferable. The Client is not permitted to sell, rent out, sublicense, dispose of the limited rights or grant limited rights or in any other way supply to a third Party, or allow a third Party to (remotely) access the Software and/or SaaS or to have a third Party host the Software and/or SaaS, not even if said third Party only uses the Software and/or SaaS on behalf of the Client. The Client shall not make any alterations to the Software and/or SaaS other than for the purposes of repairing errors. The Client shall not use the Software and/or SaaS for any third Party processing (time sharing). The source code of the Software and/or SaaS and the technical documentation produced in the development of the Software and/or SaaS will not be provided to Client, even if the Client is willing to pay a financial compensation for this provision. The Client acknowledges the confidential nature of the source code and the fact that it includes trade secrets of SC Business Application Development BV.
Unless explicitly agreed otherwise, a user right will be granted for a minimum period of one (1) year. The user right will then automatically be extended for a period of three (3) months, unless Client or SC Business Application Development BV terminates the user right In Writing, either for all Software and/or SaaS for which SC Business Application Development BV granted the Client a user right, or for part thereof. The notification shall be made before the final day of the relevant term with due observance of a notice period of three (3) months. Promptly after the expiration of the user right for the Software, the Client shall return all copies of the Software is has in its possession to SC Business Application Development BV. Should Parties have agreed that Client will destroy any copies at the expiration of the user right, Client shall confirm the destruction to SC Business Application Development BV promptly and In Writing.
The Client owes a fee to SC Business Application Development BV for the use of the Software and/or SaaS, these fees are listed in the Agreement or on the Price list should they not be included in the Agreement. The payments owed by the Client shall be paid before the due date as stated in the Agreement or Price list.
SC Business Application Development BV is entitled to affix its company name or brand name to the Software and/or SaaS it provides, or to the user interface (GUI) of the provided software, such at its discretion.
The Client is not permitted to use SC Business Application Development BV’s logos, brand names, trade names or other intellectual property in its communication (including advertisements or expressions of any kind) with third Parties without prior written consent of SC Business Application Development BV.
Article 20. Delivery, Installation and Acceptance
SC Business Application Development BV shall deliver the Software and the accompanying user documentation to Client at the time and location as stated in the Agreement. A single copy of the user documentation will be delivered, unless otherwise specified. Unless explicitly agreed otherwise, the Client shall be responsible for the proper installation and commissioning of the Software.
Should Parties have agreed, In Writing, to an acceptance test, the test period shall be fourteen (14) days after the completion of the installation or, when Parties agreed that SC Business Application Development BV would not provide the installation, upon delivery. During the test period the Client is not permitted to use the Software for productive or operational purposes. SC Business Application Development BV
may at all times require, therefore also if this is not explicitly agreed on, that the Client’s employees are sufficiently qualified to carry out an adequate test of sufficient size and scope on the (preliminary) results of the development activities and that these test results be reported to SC Business Application Development BV In Writing and in an organized and understandable format.
The Software shall be accepted between Parties:
when Parties have not agreed to an acceptance test: upon completion of the installation or, when Parties agreed that SC Business Application Development BV would not provide the installation, upon delivery, or;
when Parties agreed on an acceptance test: on the first day after the test period, or;
when SC Business Application Development BV receives a test report as referred to in paragraph 5 of this article before the end of the test period: when the errors reported in the test report have been fixed pursuant to article 10.5, notwithstanding the presence of any irregularities which, under paragraph 6, do not impair acceptance. In deviation thereof, the Software shall be considered fully accepted from the first moment of use should the Client in any way use the Software for productive or operational purposes before the moment of explicit acceptance.
Should the execution of the agreed on acceptance test show that the Software contains errors that hinder the progress of the acceptance test, the Client shall inform SC Business Application Development BV of this In Writing and shall provide sufficient detailed information, in which case the test period will be suspended until the Software can be adjusted in such a way that the cause of the hinderance is suitably remedied.
Should the execution of the agreed on acceptance test show that the Software contains errors as referred to in article 10.5, the Client shall inform SC Business Application Development BV of these errors in a detailed test report In Writing, no later than on the final day of the test period. SC Business Application Development BV shall make every effort to remedy the errors within a reasonable period of time and may apply temporary solutions, program bypasses or problem-avoiding restrictions to the Software and/or SaaS during that time.
Acceptance of the Software and/or SaaS may not be withheld on other grounds than those in connection with the specifications explicitly agreed on between Parties and therefore not because of minor errors, such as errors that do not impede the operational or productive commissioning of the Software and/or the SaaS, without prejudice to SC Business Application Development BV’s obligation to remedy these minor errors pursuant to the error recovery scheme under article 21, where applicable. Furthermore, acceptance may not be withheld for aspects of the Software and/or SaaS with a subjective nature, such as the design of the user interfaces.
Should the Software be delivered and tested in phases and/or parts, the non-acceptance of a certain phase and/or part shall not impair any acceptance of a previous phase and/or another part.
Acceptance of the Software in one of the ways listed in paragraph 3 of this article shall mean that SC Business Application Development BV has fully fulfilled the performance of its obligations for the development and provision of the Software and/or SaaS and, when in a particular case Parties agreed that the installation would also be provided by SC Business Application Development BV, of its obligations for the installation of the Software and/or SaaS. Acceptance of the Software and/or SaaS shall not in any way impair the Client's rights under paragraph 6 of this article regarding minor defects and Article 21 regarding repairs.
Should Parties not have agreed on an acceptance test, the Client accepts the Software and/or SaaS in the state it is in at the time of delivery (‘as is’), therefore with any visible and invisible errors and other defects, without prejudice to the obligations of SC Business Application Development BV pursuant the error recovery scheme of article 21. The provisions of paragraph 8 of this article shall remain in full force at all times.
Article 21. Error Repair
SC Business Application Development BV does not guarantee that the Software and/or SaaS shall work without interruption, errors or other defects or that all errors and other defects can be repaired.
SC Business Application Development BV shall make every effort to recover errors in the Software as referred to in article 10.5 within a reasonable period of time if these are reported to SC Business Application Development BV, In Writing and containing as much detail as possible, within six (6) months after delivery, or, if Parties agreed on an acceptance test, within six (6) months after acceptance.
In derogation of the provisions of paragraph 2 of this article and any other provisions with regard to Software elsewhere in these terms, a SaaS is always delivered “as is”. Therefore, the Client cannot claim any remedy of errors or other defects in
regard to the SaaS. This provision does not apply if and to the extent that the SaaS was tailor made and developed by SC Business Application Development BV at the instruction of the Client.
Recovery of Software errors will be made free of charge, unless the Client commissioned SC Business Application Development BV to develop the Software other than for a fixed price, in which case SC Business Application Development BV shall charge its usual recovery rates. SC Business Application Development BV may charge its usual recovery rates in the event of improper useby Client or if errors are brought on by any other causes not attributable to SC Business Application Development BV or when the errors could have been identified during the execution of the agreed on acceptance test. Recovery of any corrupt or lost Data is not subject to the obligation of error recovery. The obligation to recover errors shall lapse should the Client make any changes to the Software (or has a third Party make these changes on its behalf) without SC Business Application Development BV’s written approval, which shall not unreasonably be withheld.
Recovery of errors shall occur at a location to be determined by SC Business Application Development BV. SC Business Application Development BV is entitled to apply temporary solutions or program bypasses or problem-avoiding restrictions tothe Software.
SC Business Application Development BV does not have any obligation to recover errors that were reported after the period as referred to in paragraph 2 of this article, unless Parties entered into a maintenance agreement that includes such an obligation.
Any provisions in this article in relation to error repair shall apply unless the terms of a separate Service Level Agreement (SLA) effected between Parties dictate otherwise.
Article 22. Maintenance and Updates
Concurrently to the Agreement for the availability of the Software, the Client shall enter into a maintenance agreement or license agreement with SC Business Application Development BV. The Client shall report any errors it encounters in the Software to SC Business Application Development BV with as much detail as possible in accordance with SC Business Application Development BV’s usual procedures. Upon receipt of the report, SC Business Application Development BV shall make every effort to repair any errors as referred to in article 10.5 and/or make improvements to new versions of the Software. The results shall be put at the disposal of Client at a time and manner to be determined by SC Business Application Development BV depending on the urgency. SC Business Application Development BV is entitled to apply temporary solutions or program bypasses or problem-avoiding restrictions to the Software. The Client shall install, set up, parameterize, tune the repaired Software or new version and, if required, adapt the hardware and environment used. Unless explicitly agreed otherwise, SC Business Application Development BV shall not be obligated to convert Data.
SC Business Application Development BV does not guarantee that the Software shall work without interruption, errors or other defects or that all errors and other defects can be repaired.
SC Business Application Development BV may charge its usual repair rates in the event of improper use by Client or if errors arebrought on by any other causes not attributable to SC Business Application Development BV or if the Software was altered by a third Party other than SC Business Application Development BV. Repair of any corrupt or lost Data is not part of the maintenance.
In case improved versions (updates) of the Software become available, SC Business Application Development BV shall make these available to Client. The Client shall provide the installation and/or processing of the improved version itself. At the request of the Client SC Business Application Development BV can provide the installation and/or processing of the improved version, based on its current hourly rate. SC Business Application Development BV cannot be held to any error repair or support of previous versions when three (3) months have passed since an improved version was made available. A new version with new options and applications may be only be made available to the Client upon the effectuation of a new Agreement between Parties and may be subject to a new fee.
Updates to the SaaS shall be automatically implemented by SC Business Application Development BV. SaaS will be hosted in the cloud. This means that the Client gets the updates without having to take any measures itself.
Article 23. Software of Suppliers
If and to the extent that SC Business Application Development BV supplies third Party Software to the Client, the terms of these third Parties shall apply to the Software, these General Terms and Conditions are set aside for the purpose of this article. The Client accepts said third Party terms. These terms are available for Client’s inspection and SC Business Application Development BV shall send the Client a free copy of these terms and conditions at the latter’s request. If and to the extent that these third Party terms are
deemed or declared inapplicable to the relationship between the Client and SC Business Application Development BV for whatever reason, the provisions in these General Terms and Conditions shall remain unimpaired.
Article 24. Access to the SaaS
SC Business Application Development BV shall provide the Client access to the agreed on SaaS during the term of the Agreement. SC Business Application Development BV shall issue a user name and password for the Client which allows themaccess and configuration rights to the SaaS.
Access to the SaaS can only occur by using hardware, operating systems and browsers compatible with the provided SaaS.
The user name and password issued to the Client by SC Business Application Development BV must be kept confidential. SC Business Application Development BV is not responsible for the abuse of the user name and the password and may assume that the person logging into the SaaS by using the user name and the password of the Client, is in fact the Client. The Client must inform SC Business Application Development BV if it suspects that the user name and password have fallen into the hands of unauthorized persons. In such cases, SC Business Application Development BV may take effective and immediate action.
In addition to the applicable General Terms and Conditions (Chapter 1. General), the provisions of this chapter “Data Pro Statement” shall apply to the processing of personal Data by SC Business Application Development BV commissioned by or for the benefit of the Client.
Article 25. General Information
SC Business Application Development BV, also operating under the name Incrowd (Pro), with its registered office at Maanlander 47,3824 MN Amersfoort. If you have any questions about this Data Pro Statement in particular or Data protection in general, please contact our Data Protection Officer: security@sharecompany.nl.
We revise the security measures set out in this Data Pro Statement regularly in order to ensure that we are always prepared and up to date as far as Data protection is concerned. We keep you informed about new versions via the usual channels.
This Data Pro Statement applies to the following Services: Incrowd (Pro) of SC Business Application Development BV. Article 26. Description of the Services
Incrowd (Pro)'s web-based Content Management System (CMS) enables the Client to automatically (or not) share content with
employees interactively by use of internal communication channels: amongst others narrowcasting and/or employee app. Where possible, Incrowd (Pro) links up to internal or external sources and/or systems. The Client decides what information and Personal Data is shown on which screens and/or employee apps.
Article 27. Collecting and Processing Data
Personal Data. The Client can process Personal Data using the Services at its own discretion;
Information for internal communication purposes, such as news about the Client’s company, its staff and products;
Information on the weather, the traffic situation and general news items;
The Services are not designed to process special Personal Data such as data on criminal convictions and/or offences or medical data.
SC Business Application Development BV uses the collected Data for various purposes to perform a contract with the Client regarding Client’s use of the Services.
SC Business Application Development BV processes the following Personal Data:
![]()
SC Business Application Development BV uses the Data Pro Standard Clauses for Data Processing, which are attached to this Data Pro Statement. SC Business Application Development BV processes and stores all Data and Personal Data it processes on behalf of the Client within the EU/EEA.
Upon termination of the Agreement with the Client, SC Business Application Development BV will delete the Personal Data which he processes for the Client within 3 (three) months in such a way that it can no longer be used and accessed.
Article 28. Sub-Processors
SC Business Application Development BV may, depending on the chosen service, use the services of the following sub-processors:
Sub-processor | Purpose |
Afas | Financial order processing |
Avesqo BV | First Line Support & Installation Partner |
av@last | Installation Partner |
Axosoft | Helpdesk software tooling |
Hubspot | Marketing & sales tooling |
Equinix | Datacenter Rackspace & Hosting activities |
Firebase | Push Notifications for Mobile |
Article 29. Data Subject Rights
Taking into account the nature of the processing, SC Business Application Development BV shall assist the Client by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of the Client’s obligations, as reasonably understood by Client, to respond to requests to exercise Data Subject rights under the Data Protection Laws.
Incrowd (Pro) shall:
promptly notify the Client if it receives a request from a Data Subject under any Data Protection Law in respect of Personal Data; and
ensure that it does not respond to that request except on the documented instructions of the Client or as required by applicable laws to which SC Business Application Development BV is subject, in which case SC Business Application Development BV shall to the extent permitted by applicable laws inform the Client of that legal requirement before SC Business Application Development BV responds to the request.
Article 30. Security Policy
Technical security measures | Organizational security measures |
Encryption and privacy-friendly settings are implemented by default. Encryption settings are implemented on server level by default. | SC Business Application Development BV has conformed to the following Information SecurityManagement System (ISMS): ISO 27001. Certificate issued by an independent expert party. |
An authorization model (identifying rights and roles) which can be set up completely according to the Client’s own wishes. | SC Business Application Development BV has implemented a code of conduct. |
The possibility to enforce the use of strong passwords within the application and via group policies. | SC Business Application Development BV has implemented an internal procedure for thenotification of Data breaches and Data incidents. |
Fully redundant Datacenter. | Annual awareness training for employees about information security. |
Daily backups of both Datacenters. | Confidentiality obligations in employment contracts, hired staffing or other personnel accessing Personal Data processed under Client’s and Data Processor’s responsibility |
Monitoring of proper function of i-frames and related API’s. | Logical access control by means of knowledge, such as password or personal access codes. |
Datacenter protection with firewalls an anti-virus software. | Physical access control such as security passes. |
DMZ zone within the Datacenter within which applications are made available. |
Authorization of Data feeds on agreed upon IP- addresses and API key. | |
Authorization of API based on encrypted username/password/api | |
Forced HTTPS |
Logging and monitoring of system access (including monitoring traces of unauthorized access to Personal Data). |
Article 31. Data Breach Protocol
There is a procedure in place for reporting incidents internally. If SC Business Application Development BV discovers a Data breach within its organization, SC Business Application Development BV will inform the Client about this as soon as possible. SC Business Application Development BV will submit as much relevant information as possible, including a description of the incident, the nature of the breach, the nature of the Personal Data or the categories of Data Subjects involved. If possible, the Client will be notified within 24 hours. SC Business Application Development BV will not notify the Dutch Data Protection Authority (AP) or Data Subjects; whether or not a report is filed is and remains the responsibility of the Client. If required, SC Business Application Development BV will assist the Client during the reporting process. The Data Protection Officer (DPO) on duty deals with all communications on behalf of SC Business Application Development BV. Our DPO can be contacted by email on: security@sharecompany.nl.
In addition to the applicable General Terms and Conditions (Chapter 1. General) and the specific terms for the processing of personal Data (Chapter 3. Data Processing Statement) stated in these general terms, the provisions of this chapter, “Standard Clauses For Data Processing”, shall apply to the processing of personal Data by SC Business Application Development BV commissioned by or for the benefit of the Client.
Article 32. Definitions
The following terms have the following meanings ascribed to them in the present Chapter 4. Standard Clauses for Data Processing, in Chapter 3. Data Pro Statement and in the Data Processor Agreement:
Dutch Data Protection Authority (AP): the regulatory agency outlined in Section 4.21 of the GDPR.
GDPR: the General Data Protection Regulation.
Data Processor: the party which, in its capacity as an ICT supplier, processes Personal Data on behalf of its Client as part of the performance of the Agreement.
Data Pro Statement: a statement issued by the Data Processor in which it provides information on the intended use of its product or service, any security measures which have been implemented, sub-processors, Data breach, certification and dealing with the rights of Data Subjects, among other things.
Data Subject: a natural person who can be identified, directly or indirectly.
Client: the party on whose behalf the Data Processor processes Personal Data. The Client may be either the controller (the party who determines the purpose and means of the processing) or another Data processor.
Agreement: the agreement concluded between the Client and the Data Processor, on whose basis the ICT supplier provides services and/or products to the Client, the Data Processing Agreement being part of this agreement.
Personal Data: any and all information regarding a natural person who has been or can be identified, as outlined in Article 4.1 of the GDPR, processed by the Data Processor to meet its requirements under the Agreement.
Data Processing Agreement: the present Standard Clauses for Data Processing, which, along with the Data Processor's Data Pro Statement (or similar such information), constitute the Data Processing Agreement within the meaning of Article 28.3 of the GDPR.
Article 33. General Provisions
The present Standard Clauses for Data Processing apply to all Personal Data processing operations carried out by the Data Processor in providing its products and services, as well as to all Agreements and offers. The applicability of the Client's Data processing agreements is expressly rejected.
The Data Pro Statement, and particularly the security measures outlined in it, may be adapted from time to time to changing circumstances by the Data Processor. The Data Processor will notify the Client in the event of significant revisions. If the Client cannot reasonably agree to the revisions, the Client will be entitled to terminate the Data Processing Agreement In Writing, stating its reasons for doing so, within thirty days of having been served notice of the revisions.
The Data Processor will process the Personal Data on behalf and on behalf of the Client, in accordance with the written instructions provided by the Client and accepted by the Data Processor.
The Client or its customer will serve as the controller within the meaning of the GDPR, will have control over the processing of the Personal Data and will determine the purpose and means of processing the Personal Data.
The Data Processor will serve as the processor within the meaning of the GDPR and will therefore not have control over the purpose and means of processing the Personal Data, and will not make any decisions on the use of the Personal Data and other such matters.
The Data Processor will give effect to the GDPR as laid down in the present Standard Clauses for Data Processing, the Data Pro Statement and the Agreement. It is up to the Client to judge, on the basis of this information, whether the Data Processor is providing sufficient guarantees with regard to the implementation of appropriate technical and organizational measures so as to ensure that the processing operations meet the requirements of the GDPR and that Data Subjects' rights are sufficiently protected.
The Client will guarantee to the Data Processor that it acts in accordance with the GDPR, that it provides a high level of protection for its systems and infrastructure at all time, that the nature, use and/or processing of the Personal Data are not unlawful and that they do not violate any third party's rights.
Administrative fines imposed on the Client by the Dutch Data Protection Authority will not be able to be recouped from the Data Processor, except in the event of willful misconduct or gross negligence on the part of the Data Processor's management team.
Article 34. Security
The Data Processor will implement the technical and organizational security measures outlined in its Data Pro Statement. In implementing the technical and organizational security measures, the Data Processor will take into account the state of the art and the costs of implementation, as well as the nature, scope, context and purposes of the processing operations and the intended use of its products and services, the risks inherent in processing the Data and risks of various degrees of likelihood and severity to the rights and freedoms of Data Subjects that are to be expected considering the nature of the intended use of the Data Processor's products and services.
Unless explicitly stated otherwise in the Data Pro Statement, the product or service provided by the Data Processor will not be equipped to process special categories of personal Data or Data relating to criminal convictions and offences.
The Data Processor seeks to ensure that the security measures it will implement are appropriate for the manner in which the Data Processor intends to use the product or service.
In the Client's opinion, said security measures provide a level of security that is tailored to the risks inherent in the processing of the Personal Data used or provided by the Client, taking into account the factors referred to in paragraph 1 of this article.
The Data Processor will be entitled to adjust the security measures it has implemented if it feels that such is necessary for a continued provision of an appropriate level of security. The Data Processor will record any significant adjustments it chooses to make, e.g. in a revised Data Pro Statement, and will notify the Client of said adjustments where relevant.
The Client may request the Data Processor to implement further security measures. The Data Processor will not be obliged to honour such requests to adjust its security measures. If the Data Processor makes any adjustments to its security measures at the Client's request, the Data Processor will be allowed to invoice the Client for the costs associated with said adjustments. The Data Processor will not be required to actually implement these security measures until both Parties have agreed In Writing and signed off on the security measures requested by the Client.
Article 35. Data Breaches
The Data Processor does not guarantee that its security measures will be effective under all conditions. If the Data Processor discovers a Data breach within the meaning of Article 4.12 of the GDPR, it will notify the Client without undue delay. The "Data Breach Protocol" section of the Data Pro Statement outlines the way in which the Data Processor will notify the Client of Data breaches.
It is up to the Controller (the Client or its customer) to assess whether the Data breach of which the Data Processor has notified the Controller must be reported to the Dutch Data Protection Authority (AP) or to the Data Subject concerned. The Controller (the Client or its customer) will at all times remain responsible for reporting Data breaches which must be reported to the Dutch Data Protection Authority and/or Data Subjects pursuant to Articles 33 and 34 of the GDPR. The Data Processor is not obliged to report Data breaches to the Dutch Data Protection Authority and/or to the Data Subject.
Where necessary, the Data Processor will provide more information on the Data breach and will help the Client meet its breach notification requirements within the meaning of Articles 33 and 34 of the GDPR by providing all the necessary information.
If the Data Processor incurs any reasonable costs in doing so, it will be allowed to invoice the Client for these, at the rates applicable at the time.
Article 36. Confidentiality
The Data Processor will ensure that the persons processing Personal Data under its responsibility are subject to a duty of confidentiality.
The Data Processor will be entitled to furnish third parties with Personal Data if and insofar as such is necessary due to a court order, statutory provision or legal order to do so issued by a government agency.
Any and all access and/or identification codes, certificates, information regarding access and/or password policies provided by the Data Processor to the Client, and any and all information provided by the Data Processor to the Client which gives effect to the technical and organisational security measures included in the Data Pro Statement are confidential and will be treated as
such by the Client and will only be disclosed to authorised employees of the Client. The Client will ensure that its employees comply with the requirements outlined in this article.
Article 37. Term and Termination
This Data Processing Agreement constitutes part of the Agreement, and any new or subsequent agreement arising from it and will enter into force at the time of the conclusion of the Agreement and will remain effective until terminated.
This Data Processing Agreement will end by operation of law when the Agreement or any new or subsequent agreement between the parties is terminated.
If the Data Processing Agreement is terminated, the Data Processor will delete all Personal Data it currently stores and which it has obtained from the Client within the timeframe laid down in the Data Pro Statement, in such a way that the Personal Data will no longer be able to be used and will have been rendered inaccessible. Alternatively, if such has been agreed, the Data Processor will return the Personal Data to the Client in a machine-readable format.
If the Data Processor incurs any costs associated with the provisions of paragraph 3 of this article, it will be entitled to invoice the Client for said costs. Further arrangements relating to this subject can be laid down in the Data Pro Statement.
The provisions of paragraph 3 of this article do not apply if the Data Processor is prevented from removing or returning the Personal Data in full or in part by a statutory provision. In such cases, the Data Processor will only continue to process the Personal Data insofar as such is necessary by virtue of its statutory obligations. Furthermore, the provisions of paragraph 3 of this article will not apply if the Data Processor is the controller of the Personal Data within the meaning of the GDPR.
Article 38. The Rights of Data Subjects, Data Protection Impact Assessments (DPIA) and Auditing Rights
Where possible, the Data Processor will cooperate with reasonable requests made by the Client relating to Data Subjects claiming alleged rights from the Client. If the Data Processor is directly approached by a Data Subject, it will refer the Data Subject to the Client where possible.
If the Client is required to carry out a DPIA or a subsequent consultation within the meaning of Articles 35 and 36 of the GDPR, the Data Processor will cooperate with such, following a reasonable request to do so.
The Data Processor will be able to demonstrate its compliance with its requirements under the Data Processing Agreement by means of a valid Data Processing Certificate or an equivalent certificate or audit report (third-party memorandum) issued by an independent expert.
In addition, at the Client's request, the Data Processor will provide all other information that is reasonably required to demonstrate compliance with the arrangements made in this Data Processing Agreement. If, in spite of the foregoing, the Client has grounds to believe that the Personal Data are not processed in accordance with the Data Processing Agreement, the Client will be entitled to have an audit performed (at its own expense) not more than once every year by an independent, fully certified, external expert who has demonstrable experience with the type of Data processing operations carried out under the Agreement. The audit will be limited to verifying that the Data Processor is complying with the arrangements made regarding the processing of the Personal Data as laid down in the present Data Processing Agreement. The expert will be subject to a duty of confidentiality with regard to his/her findings and will only notify the Client of matters which cause the Data Processor to fail to comply with its obligations under the Data Processing Agreement. The expert will furnish the Data Processor with a copy of his/her report. The Data Processor will be entitled to reject an audit or instruction issued by the expert if it feels that the audit or instruction is inconsistent with the GDPR or any other law, or that it constitutes an unacceptable breach of the security measures it has implemented.
The parties will consult each other on the findings of the report at their earliest convenience. The parties will implement the measures for improvement suggested in the report insofar as they can be reasonably expected to do so. The Data Processor will implement the proposed measures for improvement insofar as it feels these are appropriate, taking into account the processing risks associated with its product or service, the state of the art, the costs of implementation, the market in which it operates, and the intended use of the product or service.
The Data Processor will be entitled to invoice the Client for any costs it incurs in implementing the measures referred to in this article.
Article 39. Sub-Processors
The Data Processor has outlined in the Data Pro Statement whether the Data Processor uses any third parties (sub-processors) to help it process the Personal Data, and if so, which third parties.
The Client authorizes the Data Processor to hire other sub-processors to meet its obligations under the Agreement.
The Data Processor will notify the Client if there is a change with regard to the third parties hired by the Data Processor, e.g. through a revised Data Pro Statement. The Client will be entitled to object to the aforementioned change implemented by the Data Processor. The Data Processor will ensure that any third parties it hires will commit to ensuring the same level of Personal Data protection as the security level the Data Processor is bound to provide to the Client pursuant to the Data Pro Statement.
Article 40. Other Provisions
These Standard Clauses for Data Processing, along with the Data Pro Statement, constitute an integral part of the Agreement. Therefore, any and all rights and requirements arising from the Agreement, including any general terms and conditions and/or limitations of liability which may apply, will also apply to the Data Processing Agreement.