Data Processing Agreement
How bouwman.io handles personal data on your behalf
Version 1.0, last updated: 23 October 2026
This data processing agreement belongs to every quote, SLA or hosting arrangement under which bouwman.io (Chamber of Commerce (KVK) no. 42155003, VAT no. NL005541039B71), based in the Netherlands, and reachable at hallo@bouwman.io, processes personal data on behalf of the client. That quote or arrangement is referred to below as the main agreement. Details that differ per client, such as contact persons and retention periods, are set out in the quote.
Why this agreement exists
The client decides why and how personal data is processed and is therefore the controller within the meaning of the General Data Protection Regulation (GDPR). In carrying out the main agreement, bouwman.io processes personal data on the client's behalf, for example by hosting a website with a contact form, managing an e-mail environment or maintaining an automation, and is therefore a processor. Article 28 GDPR requires the parties to put this in writing. This is that agreement.
1. Definitions
Terms such as personal data, processing, data subject, controller, processor, sub-processor and personal data breach have the meaning given to them by the GDPR. The annexes at the bottom of this page form part of this agreement.
2. Subject, duration and precedence
bouwman.io processes personal data solely for the services under the main agreement, for the processing activities listed in annex 1. This agreement lasts as long as the main agreement and ends automatically once bouwman.io no longer processes any personal data of the client and article 11 has been carried out.
If this agreement conflicts with the terms and conditions or the main agreement on the subject of personal data, this agreement prevails. On all other subjects, including liability, the terms and conditions of bouwman.io apply.
3. Instructions from the client
bouwman.io processes personal data only on the client's written instructions. The main agreement and annex 1 count as those instructions; the client gives any further instructions by e-mail. bouwman.io does not process the data for its own purposes and does not use it for anything other than the services.
If bouwman.io believes an instruction breaches the GDPR or other privacy legislation, bouwman.io says so immediately and carries out the instruction only once the client has confirmed it in writing. If bouwman.io is legally required to process or disclose data, for example on the demand of a public authority, bouwman.io informs the client in advance, unless the law prohibits this.
4. Confidentiality
bouwman.io keeps the personal data confidential and uses it only for the services. bouwman.io is a sole proprietorship; if a third party with access to personal data is brought in for part of the work, that third party is a sub-processor under article 6 and bound by the same confidentiality. The duty of confidentiality survives the end of this agreement.
5. Security
bouwman.io takes appropriate technical and organisational measures to protect the personal data against loss, unauthorised access, alteration and destruction, taking into account the state of the art, the costs, and the nature of the data and the risks. The measures are listed in annex 3. bouwman.io may change the measures as long as the level of protection stays the same or improves.
The client assesses whether the measures in annex 3 are appropriate for the data it has processed. If that includes special categories of personal data (such as medical data) or data about children, the client says so in advance, so the parties can assess whether additional measures are needed.
6. Sub-processors
The client gives bouwman.io general authorisation to engage sub-processors. The sub-processors currently in use are listed in annex 2; sub-processors used for one specific service only are listed in the quote. bouwman.io imposes on sub-processors by contract the same obligations as in this agreement, as far as they apply to the sub-processor, and remains responsible to the client for the sub-processors' work.
If bouwman.io wants to add or replace a sub-processor, bouwman.io gives at least 30 days' notice by e-mail. If the client has a reasonable objection, the parties look for a solution together. If that fails, the client may terminate the main agreement with effect from the date the change takes effect, without a notice period and without bouwman.io owing any compensation.
7. Transfers outside the European Economic Area
bouwman.io processes and stores personal data within the European Economic Area (EEA), unless stated otherwise in annex 2 or in the quote. A transfer to a country outside the EEA takes place only with an appropriate safeguard: an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified US providers), the European Commission's Standard Contractual Clauses, or another safeguard the GDPR permits. Annex 2 states which safeguard applies to which sub-processor.
8. Personal data breaches
If bouwman.io discovers a breach involving the client's personal data, or has a reasonable suspicion of one, bouwman.io reports it without undue delay and no later than 36 hours after discovery to the contact person named in the quote, by e-mail and, for a serious incident, by phone as well. The 36 hours are chosen so the client can notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within the statutory 72 hours.
The report contains, as far as known at the time: what happened, which data and which data subjects (by type and number) are affected, the likely consequences, and the measures bouwman.io has taken or proposes. Information that becomes known later follows in additional reports.
The client decides whether the breach is reported to the Data Protection Authority and to data subjects. bouwman.io does not report on its own initiative, unless the client asks it to or the law requires bouwman.io to. bouwman.io helps the client investigate and contain the breach, and keeps a register of breaches affecting the client.
9. Data subject rights and other assistance
If bouwman.io receives a request or complaint from a data subject about the client's personal data, bouwman.io forwards it within 5 working days and does not handle it itself. bouwman.io helps the client, as far as reasonably possible and taking into account the nature of the processing, with responding to data subject requests (access, rectification, erasure, restriction, portability, objection), with a data protection impact assessment and with consulting the Data Protection Authority.
Assistance that takes more than one hour per request, or that results from a request not attributable to bouwman.io, is charged at the hourly rate of the main agreement, or deducted from the SLA hours if the client has an SLA.
10. Information and audits
On request, bouwman.io makes available the information the client needs to demonstrate compliance with the obligations of article 28 GDPR: a description of the measures in annex 3, the current list of sub-processors and, where available, certifications or audit reports of sub-processors.
If that information is demonstrably insufficient for the client, the client may have an audit carried out at most once a year by an independent expert bound by confidentiality, with at least 30 days' notice, on working days, and without disrupting services to other clients. The client bears the cost of the audit, unless it reveals a material failure by bouwman.io. Reasonable time bouwman.io spends on the audit is charged at the hourly rate of the main agreement.
11. End of processing
When the main agreement ends, bouwman.io returns the personal data within 30 days at the client's request in a common file format, or provides access so the client can transfer it themselves. After that, or if the client does not ask for the data to be returned, bouwman.io deletes the personal data and any copies within 30 days of the end of the main agreement, and confirms this by e-mail.
Backups containing personal data are not deleted separately but expire automatically after the retention period set out in the quote. Until then they are not used, except to restore data at the client's request. Data bouwman.io is legally required to keep, such as invoicing data, is kept for that statutory period.
12. Liability and fines
Liability is governed by the terms and conditions of bouwman.io, including the limitation of liability set out there. Each party bears any administrative fines imposed on it for its own breach of the GDPR. The client remains responsible for the lawfulness of the processing, the legal basis, the privacy statement on its own website and informing data subjects.
13. Acceptance and other provisions
Accepting by e-mail the quote or agreement that refers to this data processing agreement, or with which it was sent, counts as signing it, including the annexes. If the client would like a signed copy, that can be arranged via hallo@bouwman.io.
Changes to this agreement apply only once both parties have confirmed them in writing (including by e-mail); a new version on this page applies to existing clients only after their consent, except for a change of sub-processors under article 6. If a provision becomes invalid, the rest remains in force and the parties replace the invalid provision with a valid one that comes as close as possible to its purpose. This agreement is governed by Dutch law.
Annex 1: processing activities
Which of these activities apply to a client follows from the services in the quote. The client sets the retention periods; they are stated in the quote.
| Service | Purpose | Data subjects | Personal data |
|---|---|---|---|
| Website hosting and management | Keeping the website online, making forms work, making and restoring backups | Website visitors, the client's customers and prospects | Name, e-mail address, phone number and message content from forms; IP address and browser data in server logs; account data of CMS users |
| Management of Google Workspace or Microsoft 365 | Managing users, mailboxes, security and settings | The client's employees and the people who e-mail them | Name, e-mail address, job title, contents of mailboxes and documents (accessed only when management work requires it, never routinely) |
| E-mail marketing | Setting up and sending newsletters on the client's behalf | Newsletter subscribers | Name, e-mail address, sign-up date and source, open and click behaviour |
| Automation and integrations | Moving data between the client's systems | The client's customers, leads and employees | Name, contact details, order or booking data, as present in the connected systems |
| SLA support | Answering questions and fixing faults in the systems above | As above | As above, only as far as the request requires |
Annex 2: sub-processors
The sub-processors bouwman.io currently uses. A sub-processor used for one service only, such as a newsletter tool, is listed in the quote for that service.
| Sub-processor | Service | Location | Transfer safeguard |
|---|---|---|---|
| Render Services, Inc. | Hosting of websites and applications | EU (Frankfurt), with possible support access from the US | EU-US Data Privacy Framework and Standard Contractual Clauses in Render's data processing agreement |
| Vimexx | Hosting of websites, e-mail and domain names | Netherlands | Not applicable, processing within the EEA |
| Neon, Inc. | Managed PostgreSQL databases and backups for applications | EU (Frankfurt), with possible support access from the US | EU-US Data Privacy Framework and Standard Contractual Clauses in Neon's data processing agreement |
| Google Ireland Limited | Google Workspace: bouwman.io's own e-mail and documents, and Google Workspace accounts clients buy through bouwman.io | EU, with possible transfer to the US | EU-US Data Privacy Framework and Google's Standard Contractual Clauses |
| Make (Celonis) | Automations and integrations between systems | EU | Not applicable, processing within the EEA |
| Postmark (ActiveCampaign, LLC) | Transactional e-mail from websites and applications | United States | Standard Contractual Clauses in Postmark's data processing agreement |
| Resend, Inc. | Transactional e-mail from websites and applications | United States | Standard Contractual Clauses in Resend's data processing agreement |
| Proton AG | Password management and encrypted storage | Switzerland | European Commission adequacy decision for Switzerland |
Annex 3: security measures
Organisational
- Only Remco Bouwman has access to clients' systems. A stand-in gets temporary access only after notice, and that access is revoked afterwards.
- Clients' credentials are kept in a password manager and never shared by e-mail or chat; every system has a unique, strong password.
- Two-step verification on all bouwman.io admin accounts and, where the system allows it, on admin accounts at clients.
- Access to clients' mailboxes and documents only when management work requires it, and never routinely.
- Work devices are encrypted, lock automatically and are updated as soon as updates are available.
- A register of data breaches and of processing activities per client.
Technical
- Connections to websites and management environments are encrypted only (TLS, with certificates that renew automatically).
- Updates of the CMS, themes and plugins with a backup beforehand and a check afterwards.
- A security layer on websites: login screen protection, login attempt limits and malware scanning.
- Backups that are automatic and encrypted, stored in a different location from the website, with periodic restore tests.
- Uptime monitoring with an alert on downtime.
- Logging of management actions where the platform supports it.
Annex 4: contact persons
The client's contact person for data breaches and, where there is one, the data protection officer are named in the quote. At bouwman.io it is Remco Bouwman, viahallo@bouwman.io.