Data processing agreement

This data processing agreement belongs to the agreement for the use of Sonar between:

• Processor: LEGAL ENTITY NAME, registered with the Dutch Chamber of Commerce under number CHAMBER OF COMMERCE NUMBER, established at REGISTERED ADDRESS ("we");
• Controller: the organisation that subscribes to the workspace and accepts this agreement in the app ("you").

1. Subject and roles

1. You decide which data you record in your workspace and why. You are the controller; we are the processor within the meaning of article 28 GDPR.
2. We process personal data only to provide the service and only on your written instructions. The settings you choose in the app count as instructions.
3. Further instructions and exceptions (for example legal obligations), to be completed by the lawyer.

2. Nature, purpose and duration of the processing

1. Purpose: providing a CRM with a map, e-mail, calendar and the integrations you switch on yourself.
2. Types of data: names, contact details, job titles, addresses and coordinates, notes, e-mail and attachments, meetings, documents, and the data you add yourself in custom fields.
3. Data subjects: contacts and leads of your organisation, and the users of your workspace.
4. Duration: as long as the agreement runs, and after that until the data is deleted under article 8.

3. Confidentiality

Everyone who has access to your data on our behalf is bound to confidentiality. Support inside your workspace is only possible with your consent, for a limited time, and is recorded in the audit log. Conditions for emergency access without consent, to be completed by the lawyer.

4. Security

We take appropriate technical and organisational measures. At present these include:

• mandatory two-factor authentication for all users and operators;
• separation of workspaces in the application and below it in the database (row level security);
• encrypted connections, and encrypted backups (AES-256);
• an audit log of changes and of operator actions;
• a strict Content Security Policy against script injection.

Further measures and certifications, to be completed by the lawyer and the platform operator.

5. Sub-processors

1. You give us general authorisation to engage the sub-processors listed in the annex. The list is generated from the settings of each integration and is also public on the Sub-processors page.
2. When a sub-processor is added, we mail the owners of your workspace. Term and effect of an objection to a new sub-processor, to be completed by the lawyer.
3. Integrations with a processor in the United States are off by default. They are only switched on when you choose so in your workspace.
4. We impose the same obligations on sub-processors as in this agreement.

6. Transfers outside the EU

7. Data subject rights and data breaches

1. In the app you can export the data of a person and have a person forgotten. We assist you with data subject requests where needed.
2. In case of a personal data breach we inform you term, to be completed by the lawyer after we discover it, with the information you need for a notification.

8. End of the agreement

1. After cancelling, your workspace stays read-only for 30 days. During that time you can make a full export. An export stays available for 7 days.
2. After that we delete all data of the workspace from the database and file storage. The owners receive a deletion certificate by mail.
3. Encrypted backups still hold the data for up to 12 months; after that the rotation has removed them.
4. Invoices and quotes are kept for 7 years because of the fiscal retention duty.

9. Audits

Right to audit, frequency and costs, to be completed by the lawyer.

10. Liability

Liability and its limitations, to be completed by the lawyer.

11. Changes, governing law

1. You accept a new version of this agreement in the app. Your workspace keeps working until 30 days after publication; after that it waits for acceptance.
2. Governing law and competent court, to be completed by the lawyer.

Privacy contact: PRIVACY ADDRESS.

Annex: sub-processors