15.1 Bsure-Digital B.V. processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR" / "AVG"), the Dutch GDPR Implementation Act (UAVG), and any other applicable data protection legislation.
15.2 Where Bsure-Digital B.V. processes personal data on behalf of the Client, Bsure-Digital B.V. acts as a processor ("verwerker") within the meaning of Article 4(8) GDPR. In such cases, the parties shall enter into a Data Processing Agreement (DPA / verwerkersovereenkomst) in accordance with Article 28 GDPR before any processing takes place.
15.3 Bsure-Digital B.V. shall only process personal data on documented instructions from the Client, unless required to do so by European Union or Dutch law. In such a case, Bsure-Digital B.V. shall inform the Client of that legal requirement before processing, unless the law prohibits such information.
15.4 Bsure-Digital B.V. shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 GDPR. These measures include, where appropriate:
- Encryption of personal data;
- The ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
- The ability to restore availability and access to personal data in a timely manner in the event of a physical or technical incident;
- A process for regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures.
15.5 Bsure-Digital B.V. shall not engage a sub-processor without prior written authorisation from the Client. Where sub-processors are engaged, Bsure-Digital B.V. shall impose the same data protection obligations on the sub-processor by way of a contract, in accordance with Article 28(4) GDPR.
15.6 In the event of a personal data breach ("datalek"), Bsure-Digital B.V. shall notify the Client without undue delay and no later than 48 hours after becoming aware of the breach. The notification shall include at a minimum: the nature of the breach, the categories and approximate number of data subjects concerned, the likely consequences, and the measures taken or proposed to address and mitigate the breach.
15.7 Bsure-Digital B.V. shall assist the Client in fulfilling its obligations under Articles 32 to 36 GDPR, including obligations regarding security of processing, notification of data breaches to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), communication of breaches to data subjects, and data protection impact assessments.
15.8 Bsure-Digital B.V. shall assist the Client in responding to requests from data subjects exercising their rights under Chapter III of the GDPR, including the right of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object.
15.9 Upon termination of the Agreement, Bsure-Digital B.V. shall, at the choice of the Client, delete or return all personal data to the Client and delete existing copies, unless European Union or Dutch law requires storage of the personal data.
15.10 The Client guarantees that all personal data provided to Bsure-Digital B.V. has been collected lawfully, that the Client has a valid legal basis for processing under Article 6 GDPR, and that data subjects have been informed in accordance with Articles 13 and 14 GDPR.
15.11 Personal data shall not be transferred to a country outside the European Economic Area (EEA) unless appropriate safeguards are in place in accordance with Chapter V of the GDPR, such as Standard Contractual Clauses (SCCs) or an adequacy decision by the European Commission.
15.12 Bsure-Digital B.V. shall make available to the Client all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and shall allow for and contribute to audits, including inspections, conducted by the Client or an auditor mandated by the Client.