Data Processing Agreement

This is a translation. Only the Dutch text is binding.

Last updated: 18 October 2026. This agreement forms part of the General Terms and Conditions.

Overview

Parties

1. The customer, the company that has entered into the agreement for Servaro, hereinafter "controller" or "customer".
2. Netwerkplek IT B.V., trading as Servaro, located at Veersedijk 59, 3341 LL Hendrik-Ido-Ambacht, the Netherlands, KvK 85523968, hereinafter "processor" or "Servaro".

Why this agreement

A. The customer uses Servaro to plan and carry out its work, such as maintenance, service and inspections.

B. In doing so, Servaro processes personal data for the customer. The customer determines the purposes and means. The customer is therefore the controller and Servaro is the processor within the meaning of the General Data Protection Regulation (GDPR).

C. The GDPR (article 28) requires them to make arrangements about this. Those arrangements are set out in this agreement.

Article 1. Definitions

1.1 Terms such as personal data, processing, data subject, controller, processor, sub-processor and personal data breach (data breach) have the meaning given in the GDPR.

1.2 Main agreement: the agreement between the customer and Servaro on the use of Servaro, including Servaro's General Terms and Conditions.

1.3 Customer data: as defined in the General Terms and Conditions.

1.4 Working day: Monday to Friday, except Dutch public holidays.

Article 2. Subject and term

2.1 This agreement concerns the personal data that Servaro processes for the customer when providing the service. Annex 1 sets out which data, about whom, for what purpose and for how long.

2.2 This agreement forms part of the main agreement. It starts and ends at the same time, including during a trial. Articles that by their nature continue, such as article 4 (confidentiality) and article 13 (end), remain in force after the end.

2.3 If this agreement and the main agreement say something different about personal data, this agreement prevails.

Article 3. The customer's instructions

3.1 Servaro only processes the personal data on the customer's written instructions. The customer gives its instructions through the main agreement, this agreement and the way it configures and uses the service.

3.2 Servaro does not use the personal data for its own purposes. Nor does Servaro use it to train AI models.

3.3 If the law requires Servaro to do something else with the data, Servaro informs the customer in advance, unless the law prohibits this.

3.4 If Servaro believes an instruction breaches the GDPR or another privacy law, Servaro informs the customer immediately. Servaro does not then have to carry out that instruction until the customer has amended or confirmed it.

3.5 The customer is responsible for having the right to process the personal data, on a valid legal basis, and for informing data subjects properly. This also applies to the location feature (GPS), which the customer only switches on if it is permitted to do so.

3.6 The customer does not put special categories of personal data, criminal records data or citizen service numbers (BSN) into the service. If Servaro notices that this happens anyway, Servaro informs the customer. The customer then removes that data.

3.7 AI features only make suggestions. A user on the customer's side checks and approves a suggestion before it is saved or sent. The AI features do not make decisions about people.

Article 4. Confidentiality

4.1 Servaro keeps the personal data confidential.

4.2 Only Servaro employees who need the data for their work are given access. They have a confidentiality obligation in their employment or service contract, or have signed a confidentiality statement.

4.3 Servaro only looks at customer data when this is needed for support at the customer's request, to resolve an outage or for security. Servaro records such access in the audit log.

Article 5. Security

5.1 Servaro takes appropriate technical and organisational measures to secure the personal data, as required by article 32 GDPR. Those measures are set out in Annex 2.

5.2 Servaro takes into account the state of the art, the costs, the type of data and the risks to data subjects.

5.3 Servaro may change the measures, but the level of security may not decrease.

5.4 Servaro regularly checks whether the measures still work properly and adjusts them where necessary.

5.5 No security is perfect. Servaro does not guarantee that nothing will ever go wrong, but does what is reasonably possible.

5.6 The customer is responsible for security on its own side, such as its users' devices, the management of accounts and permissions, and keeping login details secret.

Article 6. Sub-processors

6.1 The customer gives Servaro general authorisation to engage sub-processors. The sub-processors Servaro currently uses are listed in Annex 3.

6.2 Servaro imposes on every sub-processor, in writing, at least the same privacy obligations as those in this agreement.

6.3 If Servaro wants to add or replace a sub-processor, Servaro notifies the customer's contact person by email at least 30 days in advance. Servaro also publishes the new list at servaro.nl/subverwerkers.

6.4 Within those 30 days, the customer may object in writing, for reasons related to privacy or security. Servaro and the customer then look for a solution together. If that does not work, the customer may cancel the main agreement free of charge with effect from the date on which the new sub-processor starts.

6.5 If Servaro has to replace a sub-processor quickly, for example because it goes bankrupt or has a serious security problem, Servaro may shorten the 30-day period. Servaro then gives notice as quickly as possible and the customer keeps its right under article 6.4.

6.6 Servaro remains responsible to the customer for its sub-processors.

6.7 Services that the customer chooses and purchases itself, such as logging in via Microsoft Entra ID, are not sub-processors of Servaro. The customer makes its own arrangements with that supplier.

Article 7. Where the data is processed

7.1 Servaro processes and stores the personal data on its own servers in the Netherlands.

7.2 Servaro does not transfer personal data to countries outside the European Economic Area (EEA), unless the customer gives prior written consent and the GDPR permits it.

7.3 Some sub-processors belong to a company outside the EEA, even if the processing takes place in the EU. Annex 3 states the safeguards for each sub-processor.

Article 8. AI processing

8.1 For AI features, Servaro only sends the data needed for the suggestion, for example a voice recording or the text of a work report.

8.2 Servaro only uses AI services where the processing takes place in the EU and where the supplier does not use the data to train models.

8.3 The customer can switch off AI features for its entire environment in the settings. No data is then sent to AI suppliers.

Article 9. Rights of data subjects

9.1 A data subject can ask the customer for access, rectification, erasure, restriction, portability or can object. The customer handles such requests.

9.2 The customer can carry out most requests itself in the service, for example by changing, deleting or exporting data.

9.3 If the customer cannot carry out a request itself, Servaro helps within reasonable limits.

9.4 If Servaro itself receives a request from a data subject, Servaro forwards it to the customer within 2 working days. Servaro does not respond on the substance itself, unless the customer asks it to.

Article 10. Assistance with security, DPIAs and the supervisory authority

10.1 Servaro helps the customer to meet its obligations under articles 32 to 36 GDPR. For example with information for a data protection impact assessment (DPIA), or if the customer has to consult the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) in advance.

10.2 Servaro provides standard information about the service and its security free of charge. If the assistance takes more than 1 hour per calendar year, Servaro may charge the extra time at its standard hourly rate, after a quotation in advance.

10.3 If the customer falls under the Dutch Cybersecurity Act (Cyberbeveiligingswet), Servaro will, on request, provide reasonable information about the security of the supply chain. Article 10.2 then also applies.

Article 11. Data breaches

11.1 If Servaro discovers a data breach affecting the customer's personal data, Servaro notifies the customer without undue delay, and no later than 24 hours after Servaro discovered the breach.

11.2 Servaro reports it by email and phone to the contact person the customer has designated for this. If the customer has not designated anyone, the notification goes to the account administrator.

11.3 In the notification, Servaro gives what it knows at that moment:

• what has happened and when;
• which types of data and data subjects are affected, and approximately how many;
• what the likely consequences are;
• what Servaro has done and will do to stop the breach and limit the damage;
• whom the customer can call for more information.

11.4 If Servaro does not yet know everything, Servaro provides the remaining information as it becomes available.

11.5 The customer decides whether to report the data breach to the Dutch Data Protection Authority and to the data subjects. The customer must report to the supervisory authority within 72 hours. Servaro assists with this. Servaro does not report on the customer's behalf, unless the customer asks it to in writing.

11.6 Servaro keeps a record of all data breaches, with the facts, consequences and measures taken.

11.7 Servaro does not charge for assistance with a data breach caused by Servaro or its sub-processor.

Article 12. Audits

12.1 On request, Servaro gives the customer all information needed to demonstrate that Servaro complies with this agreement. Servaro may also do so with a recent report from an independent party, such as a penetration test report or certificate from the last 12 months.

12.2 If that is not sufficient, the customer may have an audit carried out once per calendar year by an independent, qualified auditor bound by confidentiality.

12.3 The customer announces the audit at least 4 weeks in advance, with a plan of what will be examined. The audit takes place on working days, disrupts the service as little as possible and covers only this processing. The auditor does not see data of other customers.

12.4 The customer pays the costs of the audit, including Servaro's reasonable costs. If the audit shows that Servaro does not comply with this agreement on an important point, Servaro pays the costs of the audit and its own costs.

12.5 After a data breach, or if the supervisory authority asks for it, the customer may also have an audit carried out beyond the limit of once per year.

12.6 The customer gives Servaro a copy of the audit report. Servaro resolves any shortcomings found in the audit within a reasonable period.

12.7 The customer may not test Servaro's systems itself, for example with a penetration test, without Servaro's written permission.

Article 13. End: return and deletion

13.1 The customer can always export its data itself in CSV and JSON format, with the files in their original format.

13.2 After the end of the main agreement, the customer has 30 days to export its data (export period), as set out in the General Terms and Conditions.

13.3 Within 30 days after the end of the export period, Servaro deletes the customer's personal data from the production systems. The customer can also request deletion sooner.

13.4 Backups are not cleaned separately. The data disappears from them when the backups are overwritten according to the schedule, no later than 12 months after deletion. Until then, the backups remain secured and are only used to restore the service.

13.5 The audit log is an exception. On the customer's instructions, Servaro keeps the audit log for at least 7 years, so that it can later be established who did what. The audit log cannot be changed. After 2 years, IP addresses and device data in the audit log are pseudonymised. After the retention period, the audit log is deleted.

13.6 If the law requires Servaro to keep data for longer, Servaro does so only for that purpose and for as short a time as possible.

13.7 On request, Servaro confirms in writing that the data has been deleted.

13.8 Servaro does not charge for the export or the deletion.

Article 14. Liability

14.1 Servaro's liability under this agreement is governed by the rules in the General Terms and Conditions (article 19).

14.2 The customer cannot recover from Servaro any fines imposed on the customer by the Dutch Data Protection Authority, unless the fine results from intent or deliberate recklessness on the part of Servaro's management or senior staff.

Article 15. Changes and final provisions

15.1 Servaro may change this agreement in the same way as the General Terms and Conditions: with 30 days' notice and a right to cancel. Changes to Annex 3 follow article 6.

15.2 If this agreement must change because of a new law or a decision of the supervisory authority, the parties amend it together.

15.3 This agreement is governed by Dutch law. Disputes go to the District Court of Rotterdam.

Annex 1. What Servaro processes

Purposes

Servaro only processes personal data to provide the service to the customer:

• planning work, deploying technicians and creating work reports;
• recording service, maintenance and inspections, with photos, signatures and results;
• informing the customer's own customers by email, text message and through the customer portal;
• recording hours and, if the customer switches this on, technicians' locations;
• looking up company details when entering a customer;
• converting speech and text into AI suggestions that a person approves;
• logging in, security and the audit log;
• support at the customer's request.

Data subjects and data

Not permitted: special categories of personal data, criminal records data and citizen service numbers (BSN).

Retention periods

Annex 2. Security measures

Access

• Two-factor authentication is required for all users and cannot be switched off.
• Role-based access: each user only sees and does what belongs to their role.
• Servaro employees only have access when their work requires it. Access to customer data is recorded in the audit log.

Separation between customers

• Each customer has its own shielded environment in the same database.
• The database (PostgreSQL) enforces this separation itself with row-level security. The application connects with a database user without administrator rights, which cannot bypass this shielding.
• With every change, automated tests check that a customer cannot see another customer's data.

Encryption

• All traffic between users, apps and servers is encrypted with TLS.

Logging

• An audit log records who did what. The audit log cannot be changed or deleted by users or the application.
• Server logs are kept for up to 14 days.

Backups and recovery

• Regular backups of the database and files.
• Recovery to an earlier point in time is possible (point-in-time restore).
• Every quarter we restore a backup to a separate test environment to check that recovery works.

Uploads

• Uploaded files, such as photos and attachments, are scanned for viruses.

Development

• Every change to the software goes through automated security checks in the build pipeline (CI), including checks for secrets in the code and for known vulnerabilities.
• An automated security scan runs every month, and Servaro has an external penetration test carried out every year.

Organisation

• Employees and contractors with access to customer data are bound by confidentiality.
• Servaro has a procedure for data breaches (see article 11).
• The servers are in the Netherlands, at a hosting company with physical security of the data centre.

Annex 3. Sub-processors

As of 18 October 2026. Changes in accordance with article 6. The current list is at servaro.nl/subverwerkers.

The AI suppliers Mistral and Anthropic (via AWS Bedrock) only receive data when the AI features are switched on.

Not a sub-processor of Servaro, for information

Acceptance

This Data Processing Agreement applies once the customer accepts it when signing up or in the order.