This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Opttab B.V., KvK 42094716 (“Processor”), and the Customer (“Controller”). It applies whenever Opttab processes personal data on the Customer’s behalf. It takes effect automatically when the Customer accepts the Terms, so no signature is needed. Enterprise customers may request a countersigned copy at legal@opttab.com.

1. Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in the GDPR (Regulation (EU) 2016/679). Capitalised terms not defined here have the meanings in the Terms.

2. Roles and instructions

2.1 The Customer is the controller, or a processor acting for its own clients, and Opttab is the processor (or subprocessor).

2.2 Opttab processes personal data only on the Customer’s documented instructions. These are the Terms, this DPA, the Customer’s configuration of the Services and any further written instructions agreed between the parties. Opttab will inform the Customer if it believes an instruction breaches data protection law.

2.4 Opttab does not use Customer Data to train AI models. The Customer instructs Opttab to de-identify Customer Data, so that it no longer relates to an identified or identifiable person, only for the service improvement purposes in section 8.3 of the Terms. De-identified data is no longer personal data and is not covered by this DPA.

2.3 The Customer is responsible for having a lawful basis for the processing and for providing any notices to data subjects.

3. Confidentiality and personnel

Opttab ensures that everyone authorised to process the personal data is bound by confidentiality and receives security awareness training.

4. Security

Opttab implements the technical and organisational measures described in Annex 2, which are appropriate to the risk. Opttab may update these measures as long as the overall level of protection does not decrease.

5. Subprocessors

5.1 The Customer gives general authorisation for Opttab to engage subprocessors. The current list is published at /legal/subprocessors.

5.2 Opttab will give at least 30 days’ notice of a new subprocessor by updating the subprocessor page and emailing the Customer’s account owner. Where an urgent replacement is needed for security or continuity reasons, Opttab will give notice as soon as possible.

5.3 The Customer may object on reasonable data protection grounds within the notice period. The parties will discuss the objection in good faith. If it is not resolved, the Customer may terminate the affected Services and receive a pro rata refund of prepaid fees.

5.4 Opttab imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains liable for its subprocessors.

6. Assistance

Taking into account the nature of the processing, Opttab will help the Customer: (a) respond to data subject requests, mainly through the Services’ own features, and will forward any request it receives directly; (b) carry out data protection impact assessments and prior consultations; and (c) meet its security obligations. Opttab may charge reasonable costs for assistance beyond what the Services’ features provide.

7. Personal data breaches

Opttab will notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting the Customer’s personal data. The notice will include the information available at the time, and Opttab will add to it as more becomes available. Opttab will take reasonable steps to contain and remedy the breach. Notifying Opttab of a breach is not an admission of fault.

8. International transfers

Opttab hosts customer data in the European Economic Area (Amazon Web Services, Ireland). Opttab will transfer personal data outside the EEA only with appropriate safeguards under Chapter V of the GDPR. These are an adequacy decision (including the EU–US Data Privacy Framework) or the Standard Contractual Clauses (Module 2 or 3, as relevant), which are incorporated by reference where needed.

9. Audits

9.1 Opttab will make available the information reasonably needed to demonstrate compliance with this DPA, including security documentation and, once issued, its SOC 2 and ISO 27001 reports.

9.2 If that information is not sufficient, or a regulator requires it, the Customer may carry out an audit no more than once every 12 months. It must give 30 days’ notice, the audit must take place during business hours, be performed by an independent auditor bound by confidentiality, and be paid for by the Customer.

10. Return and deletion

At the end of the Services, Opttab will delete the personal data as described in section 20.3 of the Terms: available for export for 30 days, deleted from production within the following 30 days and from backups within a further 60 days. Opttab may keep data where EU or member-state law requires it, under continued confidentiality.

11. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms, to the extent the GDPR allows. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails.

Data Processing Agreement