Data processing agreement

1. Parties

The Agency, the party that accepts this agreement inside Buyerbase, acting as verwerkingsverantwoordelijke (controller).

Buyerbase, acting as verwerker (processor). Buyerbase is operated by Bogdan Alexandru Demeter, Amsterdam, the Netherlands, trading as Buyerbase. Registration of the operating company with the Dutch Chamber of Commerce (KVK) is in progress; the registration number will be added here once it is issued. The contact point for anything in this agreement is hello@buyerbase.app.

This agreement forms part of the terms of service. Where the two conflict on the processing of personal data, this agreement governs.

2. Subject matter and duration

Buyerbase processes personal data on the Agency's behalf for one purpose: to run the Buyerbase software the Agency subscribes to, so that the Agency can guide its buyers from first contact to purchase. The nature of the processing is storage, organisation, retrieval, transmission by email and portal, and erasure.

This agreement starts when the Agency accepts it and lasts as long as the Agency's workspace exists, plus the wind-down in article 9. It ends when the workspace and its data are deleted.

3. Categories of data subjects and personal data

Data subjects: the Agency's buyers and their partners where the buyer supplies those details, the Agency's own employees who hold a seat, and people who contact the Agency through a form in Buyerbase.

Categories of personal data: identifying and contact data, household composition, employment and income data, financial data relating to a purchase, property search criteria, viewing appointments and the contents of documents a buyer uploads.

The document types the product asks for by default include a copy of a passport or identity card, a payslip, an employer statement, proof of own funds and an overview of existing loans. A copy of an identity document contains a citizen service number (BSN) and a photograph. The Agency decides which document types it asks its buyers for.

4. Instructions

Buyerbase processes personal data only on the Agency's documented instructions. The Agency's use of the software is such an instruction. Buyerbase does not process the Agency's buyer data for its own purposes, does not sell it, and does not use it to train models. If Buyerbase believes an instruction breaches the AVG or other Union or Dutch data protection law, it says so before acting.

Everyone at Buyerbase with access to the Agency's data is bound to confidentiality, and that obligation survives the end of this agreement.

5. Assisting the Agency

Buyerbase assists the Agency, within what the software can do, with requests from data subjects for access, correction, erasure, restriction, portability or objection; with data protection impact assessments; and with prior consultation of the Autoriteit Persoonsgegevens. A request that reaches Buyerbase directly from a data subject is passed to the Agency rather than answered by Buyerbase. A buyer can request their own data or request deletion of their account from the portal at any time; the Agency then has 30 days to complete or refuse the request, refusing only for a stated legal reason such as an open transaction or a retention duty. Completed deletion anonymises the buyer's record and removes their documents from storage; it does not remove the audit trail of the request itself.

6. Sub-processors

The Agency gives general authorisation for the sub-processors listed in the processor table in the privacy policy, which is the single published list and is kept current. Each sub-processor is bound by an agreement with the same obligations as this one, and Buyerbase remains liable for their performance.

Buyerbase gives the Agency 30 days notice by email before adding or replacing a sub-processor. The Agency may object on reasonable data protection grounds within that period; if the objection cannot be resolved the Agency may terminate the affected part of the service without penalty.

7. Security measures

Buyerbase applies the technical and organisational measures below. This list describes what exists today, not what is planned.

• Every business table carries an agency identifier and row level security policies that scope reads and writes to the caller's agency. A suspended agency is blocked by a restrictive policy on top of those.
• Buyer documents live in a private storage bucket. There are no public buckets holding buyer data. Files are reached only through signed links that the server mints after an access check and that expire in two minutes.
• A buyer's documents are readable by the buyer, by the employee assigned to them, and by a member the Agency has explicitly given a wider view. Other seats cannot open them, at the row level and at the storage layer.
• The Agency owner has no standing access to buyer documents. Reaching one requires an explicit grant with a written reason, which expires by itself and cannot be edited or deleted.
• Every open and every download of a buyer document is recorded with the actor, the file, the time and whether a grant was used. Buyer stage changes, seat changes and setting changes are recorded the same way, by database trigger. The log cannot be updated or deleted from within the product, and the buyer can read the entries about their own documents.
• Sensitive buyer fields, income and date of birth, are masked in the query layer for members who are not the buyer's assigned employee, unless the Agency has given them a wider view.
• Two factor authentication is available and the Agency can require it for its staff. Passwords are checked against known-breached password lists at sign-up and at password change.
• Buyerbase staff signing in as an Agency owner requires a written reason, expires on a fixed timer, and writes a record the Agency itself can read in its own settings.
• Data is encrypted in transit and at rest. Error events are scrubbed before they leave for the error monitor: document identifiers, file names, storage paths and storage links, and also buyer names, email addresses, home addresses, dates of birth, income and phone numbers.
• Every subsystem holding buyer data runs in the EU: database and document storage in Ireland, application compute in Dublin, error monitoring in Germany, product analytics on EU cloud. The region of the transactional email provider, which holds buyer email addresses, is being confirmed and is stated as unconfirmed rather than as EU.

What is deliberately not claimed: Buyerbase staff access is restricted by policy and recorded, not architecturally prevented; documents are not encrypted under a key the Agency holds; and Buyerbase holds no third party security certification and names none here.

8. Personal data breaches

Buyerbase notifies the Agency of a personal data breach affecting the Agency's data without undue delay and in any event within 72 hours of becoming aware of it, by email to the Agency owner and to the security contact the Agency has given.

The notice states what happened, the categories of personal data and roughly how many data subjects are affected, the likely consequences, the measures taken or proposed, and a contact point. Information that is not available at the time is supplied as it becomes available, without further undue delay. The Agency, as controller, decides whether to notify the Autoriteit Persoonsgegevens and the data subjects.

9. Return and deletion

The Agency can export its own data at any time while the workspace exists, in CSV or JSON, including the documents its buyers uploaded. On termination the Agency keeps that export window for the period stated in the privacy policy, after which Buyerbase deletes the Agency's data and its buyers' documents, except where Union or Dutch law requires Buyerbase to keep something.

Buyer documents are removed on the retention period the Agency chooses in its own settings. There is no default period and Buyerbase does not remove a buyer document until the Agency sets one, because the Agency's own retention duties under the Wwft run independently of what Buyerbase holds and only the Agency can weigh them. Removal is recorded on the record it belonged to.

10. Audit

Buyerbase makes available to the Agency the information needed to demonstrate compliance with this agreement, and allows for and contributes to audits, including inspections, conducted by the Agency or by an auditor it mandates. An audit is announced at least 30 days in advance, happens during working hours, may take place once in a twelve month period unless a breach gives cause for more, and may not disrupt the service or expose another agency's data. The Agency bears the cost of an audit it initiates unless the audit finds a material breach of this agreement.

Buyerbase holds no third party audit report and this agreement names none. Where one exists in future it may be offered in place of an on-site inspection.

11. Transfers outside the EEA

The sub-processors that hold buyer data process it inside the EU or the EEA. Where a sub-processor named in the privacy policy processes data outside the EEA, that transfer runs on the European Commission's standard contractual clauses together with the supplementary measures those clauses require. The processor table states the location of each one.

12. Liability and governing law

Liability under this agreement is governed by the liability clause in the terms of service. Dutch law applies and disputes go to the competent court in Amsterdam, the Netherlands. A Dutch text of this agreement is prepared on request and governs where the two texts differ, since the counterparty is Dutch.

Signed for Buyerbase by Bogdan Alexandru Demeter. To receive a countersigned copy, write to hello@buyerbase.app naming the agency.

13. Assignment and change of legal entity

Buyerbase is operated today by a natural person trading under a registered trade name. Buyerbase intends to move the business into a Dutch private limited company (besloten vennootschap) incorporated by that same operator. Buyerbase may transfer this agreement, together with the terms of service and the Agency's workspace, to that company. The Agency consents to that transfer in advance, on all of the following conditions.

• The company takes on this agreement unchanged, with the same obligations towards the Agency and towards its buyers, and the Agency keeps every right it has under this agreement.
• The processing, the sub-processors, the security measures and the locations in article 7 do not change by reason of the transfer alone. A later change to any of them follows article 6 and article 11 as it otherwise would.
• Buyerbase notifies the Agency in writing at least 30 days before the transfer takes effect, naming the company and its Chamber of Commerce number.
• The Agency may object on reasonable data protection grounds within those 30 days. If the objection cannot be resolved, the Agency may terminate without penalty and export its data under article 9.

This advance consent covers that one transfer and nothing else. Buyerbase may not otherwise transfer this agreement to a third party without the Agency's consent, and a transfer to an unrelated acquirer is not covered here. The Agency may transfer this agreement to a party that takes over its own undertaking, with Buyerbase's consent, which is not unreasonably withheld.