Data Processing Agreement

1. Parties

This Data Processing Agreement (DPA) is entered into between:

The Controller is the organization that accepts this DPA when using InBrandevoort to publish content (posts, events, news, etc.). This includes both manually created content and automated imports via the news scraping feature. By using these features, the organization enters into this agreement.

2. Definitions

• Controller: The organization that determines the purposes and means of processing personal data (the organization enabling news import)
• Processor: InBrandevoort, who processes personal data on behalf of the Controller
• Personal Data: Any information relating to an identified or identifiable natural person
• Processing: Any operation performed on personal data, including collection, storage, retrieval, use, disclosure, or deletion
• Sub-processor: A third party engaged by the Processor to process personal data on behalf of the Controller
• Data Subject: An identifiable natural person whose personal data is processed
• EEA: European Economic Area

3. Priority and Scope

This DPA supplements and forms an integral part of any agreement between the parties. In case of conflict between this DPA and other agreements (including the general Terms and Conditions), this DPA shall prevail with respect to data protection matters.

4. Subject Matter and Purpose

This DPA governs the processing of personal data when the Controller uses InBrandevoort to publish and manage content. The processing includes:

• Storing content created manually by the Controller (posts, events, news articles, images, organization information)
• Scraping news articles from the Controller's designated website (an optional import feature that the Controller may enable or disable at any time)
• Translating text content to support multilingual display (text only, no images are sent to translation services)
• Creating text-based summaries of content (text only, no images are sent to AI services)
• Moderating text content for community safety (text only, data-minimized processing)
• Displaying the content across all InBrandevoort services (website, web app, and mobile apps)

5. Duration

This DPA remains in effect for as long as the Controller uses InBrandevoort to publish or manage content. Upon ceasing use or disabling features, previously published content remains stored unless the Controller requests deletion. The DPA terminates when all personal data has been deleted or returned.

6. Types of Personal Data

The following categories of personal data may be processed, but only if the Controller enters this information manually or if it appears on the Controller's public website that is being scraped:

• Names of article authors
• Photographs of individuals appearing in content (stored by InBrandevoort only, not shared with translation or AI sub-processors)
• Names of individuals mentioned in content
• Any other personal information published by the Controller
• Contact information if included in content

7. Categories of Data Subjects

Personal data may relate to the following categories of data subjects:

• Authors and contributors to the Controller's website
• Individuals mentioned or photographed in news articles
• Members or participants of the Controller's organization
• Any other individuals whose information appears in the Controller's published content

8. Controller Obligations

The Controller warrants and agrees that:

• They have the legal right to the content being scraped (it is their own website or they have explicit permission)
• They have obtained all necessary consents or have a lawful basis for any personal data contained in the content
• They have the right to publish photographs and names of individuals appearing in their news
• They will inform data subjects that their information may be displayed on InBrandevoort
• They will promptly notify InBrandevoort if any content must be removed due to legal requirements or data subject requests
• They will only provide URLs to websites they own or have explicit authorization to scrape
• They will provide documented instructions for any processing beyond the standard service functionality

9. Processor Obligations (Article 28(3) GDPR)

InBrandevoort, as Processor, shall in accordance with Article 28(3) GDPR:

• Process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by applicable law (EU or Dutch law) to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest
• Ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality
• Take all measures required pursuant to Article 32 GDPR (security of processing)
• Respect the conditions referred to in paragraphs 2 and 4 of Article 28 GDPR for engaging another processor (sub-processor)
• Taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III GDPR
• Assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to the Processor
• At the choice of the Controller, delete or return all the personal data to the Controller after the end of the provision of services relating to processing, and delete existing copies unless applicable law (EU or Dutch law) requires storage of the personal data
• Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller

10. Sub-processors

The Controller grants general authorization for InBrandevoort to engage sub-processors. The current authorized sub-processors are:

• Microsoft Azure: Cloud storage and infrastructure for storing content
• Google Translate: Translation services for text content only (data-minimized, no images or unnecessary personal data transmitted)
• EdenAI and OpenAI: Content moderation, AI-generated summaries, and NSFW content detection for text content only (data-minimized, no images or unnecessary personal data transmitted)

InBrandevoort shall inform the Controller in writing of any intended changes concerning the addition or replacement of sub-processors at least 14 days before the change takes effect, thereby giving the Controller the opportunity to object to such changes.

If the Controller has reasonable grounds to object to the use of a new sub-processor, the Controller shall notify InBrandevoort in writing within 14 days of receiving notice. In case of a reasonable objection, the parties shall discuss in good faith a mutually acceptable solution. If no solution can be found within 30 days, the Controller may terminate the affected service without penalty, and InBrandevoort shall delete or return all related personal data.

InBrandevoort shall ensure that each sub-processor is bound by data protection obligations no less protective than those in this DPA.

11. Security Measures

InBrandevoort implements appropriate technical and organizational measures pursuant to Article 32 GDPR, including:

• Encryption of data in transit (TLS/HTTPS)
• Secure cloud storage with access controls
• Regular security assessments
• Access limited to authorized personnel only
• Logging of data access and modifications
• Secure API authentication
• Pseudonymization where appropriate

12. Data Subject Rights

InBrandevoort will assist the Controller in responding to data subject requests under Chapter III GDPR:

• If a data subject contacts InBrandevoort directly, we will forward the request to the Controller without undue delay
• We will provide technical assistance to fulfill access, rectification, erasure, restriction, portability, or objection requests
• Content can be modified or deleted upon Controller request at any time
• Bulk deletion of all scraped content is available upon request

13. Data Breach Notification

In the event of a personal data breach affecting the Controller's data, InBrandevoort shall:

• Notify the Controller without undue delay (and in any event within 48 hours) after becoming aware of the breach
• Provide information about the nature of the breach, categories and approximate number of data subjects concerned, categories and approximate number of personal data records concerned, likely consequences, and measures taken or proposed to address the breach
• Assist the Controller in meeting their notification obligations to supervisory authorities (Article 33 GDPR) and to data subjects (Article 34 GDPR)
• Document all breaches including facts, effects, and remedial actions taken

14. Audit Rights

The Controller has the right to audit InBrandevoort's compliance with this DPA:

• The Controller may conduct audits, including inspections, either directly or through a mandated independent auditor bound by confidentiality obligations
• InBrandevoort shall make available all information necessary to demonstrate compliance with Article 28 GDPR obligations
• InBrandevoort shall allow for and actively contribute to audits and inspections
• The Controller shall provide reasonable notice (at least 14 days) for on-site audits, except in cases of suspected breach where shorter notice is justified
• Audits shall be conducted during normal business hours with minimal disruption to operations

Each party bears its own costs for audits, unless the audit reveals material non-compliance by InBrandevoort, in which case InBrandevoort shall bear reasonable audit costs.

15. Data Retention and Deletion

Regarding data retention:

• Content is retained for as long as the Controller uses InBrandevoort to publish content
• When the feature is disabled, previously scraped content remains unless deletion is requested
• The Controller may request deletion of specific articles or all scraped content at any time
• Upon termination of this DPA, all personal data will be deleted within 30 days unless applicable law (EU or Dutch law) requires storage
• Backups may retain data for up to 90 days before complete deletion
• InBrandevoort shall certify deletion in writing upon Controller request

16. International Data Transfers

Personal data is primarily stored within the European Economic Area (EEA). InBrandevoort shall not transfer personal data to a third country or international organisation unless:

• The Controller has provided documented instructions for the transfer, or
• The transfer is required by applicable law (EU or Dutch law), in which case InBrandevoort shall inform the Controller before processing unless prohibited by law, or
• Appropriate safeguards are in place (Standard Contractual Clauses, adequacy decision, or other approved mechanism)

Where sub-processors may process data outside the EEA (e.g., Google Translate), Standard Contractual Clauses or equivalent safeguards apply. InBrandevoort conducts Transfer Impact Assessments where required, in accordance with the case law of the Court of Justice of the European Union. Details of international transfers are available in our Privacy Policy.

17. Liability

Each party is liable for damages caused by processing that infringes GDPR, to the extent set out in Article 82 GDPR. The Controller is responsible for ensuring they have the right to scrape and display the content. InBrandevoort is not liable for claims arising from content the Controller did not have the right to publish or from instructions that violate applicable law.

18. Termination and Data Return

Upon termination of this DPA:

• The Controller may request return of all personal data in a commonly used, machine-readable format
• Alternatively, the Controller may request deletion of all personal data
• InBrandevoort will complete deletion or return within 30 days of request
• InBrandevoort will certify deletion in writing upon request
• Obligations under this DPA that by their nature should survive termination (confidentiality, liability, audit rights for the retention period) shall survive

19. Governing Law

This DPA is governed by the laws of the Netherlands. Disputes will be submitted to the competent court in 's-Hertogenbosch, the Netherlands. This DPA is subject to the GDPR and shall be interpreted consistently with GDPR requirements.