Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service of sendplane.app. It applies between the customer of sendplane.app ("Customer", the controller) and Reach Digital B.V., KvK 61711454, trading as sendplane.app ("sendplane.app", the processor). The Customer accepts this DPA when they log in to sendplane.app. The DPA applies to all personal data that sendplane.app processes for the Customer, and it meets the requirements of Article 28 of the General Data Protection Regulation ("GDPR"). Terms such as "personal data", "processing" and "personal data breach" have the meaning of Article 4 GDPR.

1. Subject and duration

sendplane.app stores the forms of the Customer, receives the responses to these forms and delivers them to the Customer. Annex 1 describes the data and the processing. This DPA applies as long as sendplane.app processes personal data for the Customer.

2. Instructions

1. sendplane.app processes the personal data only on documented instructions of the Customer. The instructions are this DPA, the settings in the dashboard and the API requests with the API key of the Customer.
2. When a law of the EU or of a member state requires other processing, sendplane.app informs the Customer first, unless that law forbids it.
3. sendplane.app informs the Customer immediately when an instruction infringes the GDPR in its opinion.
4. The Customer is responsible for the lawfulness of the processing. The Customer has a legal basis for each form field, informs the visitors, for example in the privacy policy of the website, and asks for special categories of data, such as health data, only with a lawful exception of Article 9 GDPR.

3. Confidentiality

sendplane.app gives access to the personal data only to persons who need it to provide, support or secure the service. Each of these persons has a duty of confidentiality.

4. Security

sendplane.app takes the technical and organisational measures of Annex 2, as Article 32 GDPR requires. sendplane.app may replace a measure with a measure that gives the same or a higher level of security.

5. Sub-processors

1. The Customer gives general written authorisation for the sub-processors in Annex 3.
2. sendplane.app informs the owner of the account by email before it adds or replaces a sub-processor in Annex 3. The Customer may object for reasons of data protection. If the parties find no solution, the Customer may end the agreement before the change, and sendplane.app refunds the prepaid fee for the remaining period.
3. sendplane.app gives each sub-processor the same data protection obligations as this DPA, in a written contract. sendplane.app stays fully liable to the Customer for its sub-processors.

6. Transfers outside the EEA

The database and the files are in the EU. A sub-processor may process data outside the European Economic Area, for example to send email or to give support. sendplane.app permits this only with a safeguard of Chapter V GDPR: an adequacy decision, such as the EU-US Data Privacy Framework, or the Standard Contractual Clauses of the European Commission. Annex 3 shows the safeguard of each sub-processor.

7. Integrations of the Customer

When the Customer connects Slack, sendplane.app posts each new response in the Slack channel that the Customer chooses. When the Customer imports from forms.app, sendplane.app reads the forms, responses and files from forms.app with the API key of the Customer. These transfers are instructions of the Customer. The agreement between the Customer and Slack or forms.app applies to the data at that provider.

8. Requests from data subjects

1. In the dashboard, the Customer finds, exports and deletes responses and files. The Customer uses these functions to answer requests from data subjects.
2. When a data subject sends a request about data of the Customer to sendplane.app, sendplane.app sends the request to the Customer. The Customer answers it.
3. sendplane.app helps the Customer with requests that the dashboard does not cover.

9. Personal data breaches

1. sendplane.app informs the Customer without undue delay, and not later than 48 hours after it becomes aware of a personal data breach that affects the data of the Customer.
2. The notice contains the information of Article 33(3) GDPR that is available: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences and the measures taken. sendplane.app sends the missing information when it becomes available.
3. The Customer decides to notify the supervisory authority and the data subjects.

10. Assistance

sendplane.app helps the Customer with data protection impact assessments and with the prior consultation of the supervisory authority (Articles 35 and 36 GDPR), with the information that sendplane.app has.

11. Deletion

1. The Customer can export the responses as CSV and delete them at any time.
2. When the Customer deletes the account, sendplane.app deletes all forms, responses and settings immediately and all files within one day. Backups and the logs of the sub-processors keep data for up to 30 more days.
3. sendplane.app keeps a copy only when a law of the EU or of a member state requires it.

12. Audits

1. sendplane.app gives the Customer all information that is necessary to show compliance with Article 28 GDPR, including the certifications of its sub-processors.
2. The Customer may have an audit done by an independent auditor with a duty of confidentiality, once per year, with 30 days notice. The Customer pays the costs of the audit.

13. Changes and law

1. sendplane.app informs the owner of the account by email 30 days before a change of this DPA. Each change keeps at least the same protection of the personal data.
2. If this DPA and the Terms of Service conflict about personal data, this DPA applies.
3. Dutch law applies to this DPA. The court of The Hague decides disputes.

The Privacy Policy describes the data for which sendplane.app is the controller.

Annex 1: Processing

Annex 2: Security measures

Annex 3: Sub-processors