Data Processing Agreement

1. Parties and roles

The Processor is Heerden & Co, trade name of ABSVH Investments B.V. (KvK 76998568), Box C6827, Keurenplein 41, 1069 CD Amsterdam, Netherlands. The Controller is the client that engages Heerden & Co. The Controller determines the purposes and means of the processing; the Processor acts only on the Controller's documented instructions.

2. Subject, nature and purpose

The Processor processes personal data only to the extent needed to deliver the engagement agreed with the Controller — reviewing marketing performance, analysing data end to end, diagnosing the constraint, and designing and installing the marketing system. Processing lasts for the duration of the engagement.

3. Data and data subjects

Depending on the engagement, the personal data processed may include:

• Data subjects: the Controller's customers, prospects, and staff.
• Categories of data: contact details, transaction and order data, marketing and analytics identifiers, and communication records contained in the systems the Controller gives access to.

The Processor does not process special categories of personal data unless expressly agreed in writing.

4. Processor obligations

• Process personal data only on the Controller's documented instructions, including for international transfers, unless required otherwise by law.
• Ensure that persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (section 5).
• Not engage another processor without the Controller's authorisation (section 6).
• Assist the Controller in meeting its GDPR obligations (section 8).
• Delete or return the data at the end of the engagement (section 9).
• Make available the information needed to demonstrate compliance (section 10).

5. Security measures

The Processor applies measures appropriate to the risk, including: encrypted connections (HTTPS/TLS), access on a need-to-know basis, strong authentication, use of reputable providers with their own certifications, and minimising the personal data accessed to what the engagement requires.

6. Sub-processors

The Controller gives general authorisation for the Processor to use the sub-processors below. The Processor imposes data-protection obligations on each sub-processor equivalent to those in this DPA, and remains liable for their performance. The Processor will inform the Controller of any intended change and give the Controller the chance to object.

Additional tools may be introduced for a specific engagement; where they process the Controller's personal data, they will be added to this list and notified to the Controller.

7. International transfers

Where a sub-processor processes personal data outside the European Economic Area, the transfer is covered by the EU Standard Contractual Clauses and/or the sub-processor's certification under the EU–US Data Privacy Framework.

8. Assistance and breach notification

The Processor assists the Controller, as far as reasonably possible, with responding to data-subject requests and with the Controller's obligations on security, breach notification, and data-protection impact assessments. The Processor notifies the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller's data.

9. Return and deletion

On termination of the engagement, the Processor returns or deletes the Controller's personal data at the Controller's choice, unless a legal obligation requires retention (for example, invoicing records kept for the statutory term).

10. Audits

The Processor makes available the information reasonably needed to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor it mandates, subject to reasonable notice and confidentiality.

11. Governing law

This DPA is governed by Dutch law. Disputes are submitted to the competent court in Haarlem (Rechtbank Noord-Holland).