Data processing agreement

Version 3.1 - Last updated: 1 October 2026

1. Parties and subject matter

This agreement applies between TrompTech, sole proprietorship of J. Tromp, Baliëndijk 324, 4816 GV Breda, Chamber of Commerce (KvK) 96345381 ("TrompTech", the processor), and the client that purchases the TrompTech Layer, hosting or management from TrompTech ("the Customer", the controller). It forms part of the general terms and conditions and applies automatically as soon as TrompTech processes personal data for the Customer.

Terms such as personal data, processing, data subject and breach have the meaning given in Article 4 of the General Data Protection Regulation (GDPR).

2. Instructions

• TrompTech processes the data only to provide the service, and only on the instructions of the Customer. The agreement, this data processing agreement and the settings the Customer chooses in its workspace count as those instructions.
• TrompTech does not use the data for its own purposes, does not sell it and does not use it to train a language model.
• If TrompTech considers that an instruction infringes the GDPR, it reports this immediately.
• If TrompTech is required by law to disclose data, it reports this to the Customer in advance, unless the law prohibits this.

What TrompTech processes itself as controller, such as the login details of users, the invoicing of the subscription and the usage of AI tasks, is not covered by this agreement. That is set out in the privacy statement.

3. Which data

Purpose: providing the workspace for the Customer's business operations: contacts and leads, calendar and bookings, mail, quotes and invoices, projects, tasks, hours, tickets, documents, employees and AI functions that make proposals. For hosting: the Customer's website and what visitors enter on it.

Data subjects: users and employees of the Customer; customers, leads, suppliers and their contact persons; senders and recipients of mail; people who book an appointment or fill in a form.

Data: names, email addresses, telephone numbers, company details and notes; appointments; header data and, if the Customer connects it, content of mail; quotes, invoices and contracts; projects, tasks and hours; job title and contact details of employees; conversations with the AI.

The Customer does not put special categories of personal data (such as health), criminal data or citizen service numbers (BSN) in the workspace, unless we agree on this together in writing. The workspace has no fields for these, and the Employees module deliberately does not record salary, BSN, address or sickness.

The Customer only puts data in the workspace for which it is itself the controller, not data that one of its own customers has entrusted to it as processor, unless we make separate arrangements about this together.

4. Retention

The workspace applies a number of retention periods itself, every night:

• Lost leads: 2 years after the last activity.
• Bookings: anonymised 12 months after the meeting.
• Mail header data in the search index: 12 months after the mail date.
• Conversations with the AI: 12 months after the last message. AI proposals: 12 months after the decision.

Quotes, invoices and the rest of the accounting records are not deleted automatically by the workspace, because the Customer must keep them for 7 years. Other data remains until the Customer deletes it or the agreement ends (Article 11).

5. Confidentiality and access

TrompTech keeps the data confidential. Anyone who has access on behalf of TrompTech is bound by confidentiality; at present that is only J. Tromp. If someone is added, TrompTech reports this. TrompTech only looks into a workspace if that is necessary for support the Customer asks for, for security or recovery after an outage, or because the law requires it. If TrompTech looks into the workspace, the workspace records this in an access log, with date, time, reason and explanation. The Customer's administrators see that log in the workspace, under Team. Personnel data in the Customer's workspace is not visible to TrompTech in the app.

6. Security

TrompTech takes appropriate measures (Article 32 GDPR). These include:

• All connections are encrypted over https.
• The server is only open to web traffic. Administration is only possible via a shielded connection with a key, and security updates are installed automatically.
• Each workspace runs in its own process that only sees its own folder.
• Integration secrets, conversations with the AI, AI proposals, calendar access and mail on a custom domain are stored encrypted.
• Passwords are only stored encrypted, and the number of login attempts is limited.
• Two-step verification (a code app or a passkey) is mandatory for those who administer the workspace, and for everyone if the Customer chooses so.
• An access log records logins, failed attempts, logouts and viewing by TrompTech. It can only grow and is kept for one year.
• Users are given roles and permissions. For each module, a record is kept of who changed what.
• Every night an encrypted backup outside the server, kept for 60 days (see Service & availability).

TrompTech may adjust the measures, as long as the level does not go down. The Customer is itself responsible for whom it gives access, which roles it assigns and which integrations it switches on.

7. Subprocessors

The Customer consents to the subprocessors listed on the subprocessors page, with what each party does, which data, where, and on which basis for transfers outside the European Economic Area. TrompTech imposes on them the same obligations as in this agreement, insofar as the service allows, and remains responsible towards the Customer.

TrompTech notifies a new or different subprocessor at least 30 days in advance by email. The Customer may object within that period. If we cannot reach agreement together, the Customer may terminate with effect from the date of the change, without costs for the rest of the period.

Services that the Customer connects itself, such as Google, Microsoft 365, Mollie or a CRM, are not subprocessors of TrompTech. For these, the Customer has its own arrangements with that service.

8. AI functions

• The AI functions work via TrompTech's business API with the language model listed on the subprocessors page. The Customer does not need its own account for this.
• TrompTech is moving the AI functions to processing in the EU: via Google Cloud (Vertex AI) or AWS (Amazon Bedrock), in a region in the EU. TrompTech announces this move at least 30 days in advance, as in Article 7. From then on, nothing for the AI functions goes to a language model outside the EU any more, and if that route is unavailable, the AI does not run.
• The Customer can only use its own API key from a provider if TrompTech enables this for the workspace. The work then runs via that key, outside the EU route. That provider is then a supplier of the Customer, not a subprocessor of TrompTech.
• Only what is needed for the task goes to the language model: the question, the instructions and the data the AI retrieves from the workspace for that purpose.
• Anything that leaves the workspace, such as an email or a change in another system, first becomes a proposal that a user approves. An administrator of the Customer can choose per type of task that it is carried out without approval, with a daily limit. That counts as an instruction of the Customer. HR matters, contracts and the status of an invoice never go ahead without approval.
• TrompTech records the usage per AI task, not the text.

9. Breaches

TrompTech reports a breach affecting the Customer's data without undue delay, and aims to report within 48 hours of discovery, so that the Customer can itself report to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours. The notification contains what TrompTech knows at that moment: what happened, which data and data subjects, the likely consequences and the measures. What becomes known later follows. TrompTech does not itself notify the supervisory authority or data subjects, unless the Customer asks it to or the law requires it. TrompTech records every breach, even if it does not need to be reported.

10. Assistance to the Customer

TrompTech assists the Customer with requests from data subjects, such as access or erasure. For this, the workspace has an export per person and the deletion of a contact. If TrompTech itself receives such a request, it forwards it to the Customer. TrompTech also assists with a data protection impact assessment (DPIA). Assistance that takes more than 2 hours per year may be charged by TrompTech at the normal hourly rate, unless it is needed because of an error by TrompTech.

11. Termination and return

After the end of the agreement, the Customer can obtain its data for 30 days: TrompTech provides it on request in a common, machine-readable format. TrompTech then erases the workspace with all data and keys. Copies in backups disappear when the backup expires, no later than 60 days afterwards; until then they remain encrypted and are only used for recovery. On request, TrompTech confirms the erasure in writing.

12. Audit

On request, TrompTech gives the Customer the information needed to show that these arrangements are complied with. If that is demonstrably insufficient, the Customer may once a year have an audit carried out by an independent expert bound by confidentiality, with 30 days' notice, during office hours and without access to data of other customers. The Customer bears the costs, unless the audit reveals a material shortcoming on the part of TrompTech. TrompTech has no certification such as ISO 27001.

13. Term and amendment

This agreement runs for as long as TrompTech processes data of the Customer. TrompTech announces an amendment at least 30 days in advance; if it is to the Customer's disadvantage, the Customer may terminate with effect from the effective date. In the event of conflict with the general terms and conditions, this agreement prevails, insofar as personal data is concerned. For liability and disputes, the general terms and conditions apply, as does Dutch law.

Questions about this agreement: info@tromptech.nl.