Data processing agreement

Article 1. Parties and roles

1.1 The parties are the customer that signs up for Zonetoegang, Tolmijden or Truckroute (hereinafter: the customer), and VYS Scheduling BV, Poolland 24, 1768 BX Barsingerhorn, the Netherlands, Chamber of Commerce 73550027 (hereinafter: VYS).

1.2 For the personal data the customer enters into the services or has processed through them, the customer is the controller and VYS the processor.

1.3 For the account data VYS needs to provide the services (such as email addresses for signing in, company and payment details, acceptances and security logs), VYS is the controller itself. This agreement does not apply to that data; the privacy statement does.

1.4 Terms such as personal data, processing, data subject, controller, processor, sub-processor and personal data breach (data breach) have the meaning given to them in the GDPR.

Article 2. Subject and duration

2.1 The subject of this agreement is the processing of personal data by VYS for the customer when providing Zonetoegang, Tolmijden and Truckroute, as described in the terms and conditions.

2.2 This agreement applies from the acceptance at sign-up, including during the trial, and for as long as the subscription runs. After that, it continues to apply for as long as VYS still processes personal data for the customer, until that data has been deleted or returned in accordance with article 13.

Article 3. Nature and purpose of the processing

3.1 VYS processes the personal data only to provide the services to the customer: giving users access to the customer's account, looking up vehicle data for a number plate, and calculating and showing zones, signs, routes, charges, tolls and emissions.

3.2 The processing consists of receiving, storing, consulting, calculating, displaying and deleting. Much of the data, such as number plates entered, stays in the user's browser. Where data goes to the servers of VYS, for example to calculate a route or to retrieve vehicle data from the RDW, VYS processes it only for that purpose.

3.3 VYS does not use the data for its own purposes or for advertising, and does not sell or share it with third parties, except with the sub-processors in article 8.

Article 4. Types of personal data and data subjects

4.1 Types of personal data:

• email addresses of colleagues the customer invites as users;
• number plates that may be traceable to a person, such as those of a sole trader or a driver;
• addresses and routes, including departure and destination addresses and intermediate stops.

4.2 Data subjects: the users the customer invites, the drivers and keepers of vehicles whose number plate the customer enters, and persons whose address is used as a starting point, stop or destination, such as customers of the customer.

4.3 Special categories of personal data and criminal data are not needed for the services. The customer does not enter them.

Article 5. Processing on instructions

5.1 VYS processes the personal data only on documented instructions from the customer. Use of the services as intended, and this agreement, count as such instructions.

5.2 If VYS considers that an instruction infringes the GDPR or other data protection rules, VYS informs the customer immediately.

5.3 If VYS is required by law to provide data to an authority, VYS informs the customer in advance, unless the law prohibits this.

Article 6. Confidentiality

6.1 VYS keeps the personal data confidential. Only employees who need the data for their work have access to it, and they are bound by a duty of confidentiality.

6.2 VYS imposes the same duty of confidentiality on the sub-processors.

Article 7. Security

7.1 VYS takes appropriate technical and organisational measures to secure the personal data, taking into account the state of the art, the costs, the nature of the data and the risks. These include:

• encrypted connections (https);
• encryption of email addresses, contact details and payment details in the database;
• access control with roles and rights, so that a user only sees the data of their own company;
• signing in with a one-time code by email instead of a password;
• logging of sign-in attempts and changes in a security log that cannot be altered;
• regular backups;
• an information security management system in line with ISO 27001, for which certification is in preparation.

7.2 VYS reviews the measures regularly and adjusts them where necessary.

Article 8. Sub-processors

8.1 The customer authorises VYS to engage the following sub-processors:

8.2 VYS imposes the same obligations as in this agreement on each sub-processor in writing and remains responsible towards the customer for the sub-processors.

8.3 VYS notifies the customer in advance of a new or replacement sub-processor. The customer may object on reasonable grounds. If the parties cannot agree, the customer may cancel the subscription as of the date on which the new sub-processor starts.

Article 9. Transfers outside the European Economic Area

9.1 VYS does not transfer personal data to countries outside the European Economic Area (EEA), except through Postmark as mentioned in article 8.1. That transfer is based on the standard contractual clauses of the European Commission.

Article 10. Data breaches

10.1 VYS notifies the customer of a data breach affecting the customer's personal data without undue delay, and no later than 48 hours after discovery.

10.2 VYS provides the information the customer needs for a notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and to data subjects: what happened, which data and how many data subjects are affected, the likely consequences and the measures VYS takes or proposes. Information that is not yet known is provided by VYS as soon as it is available.

10.3 VYS immediately takes measures to limit the consequences and keeps the customer informed. The customer makes the notification to the authority and to data subjects.

Article 11. Data subject rights and assistance

11.1 VYS assists the customer with requests from data subjects for access, rectification, erasure, restriction, objection or portability. If VYS receives such a request directly, VYS forwards it to the customer.

11.2 VYS assists the customer, as far as reasonable, with a data protection impact assessment (DPIA), with a prior consultation of the supervisory authority and with complying with the security obligation.

Article 12. Information and audit

12.1 On request, VYS provides the customer with all information needed to demonstrate that VYS complies with this agreement and with Article 28 GDPR.

12.2 If that information is not sufficient, the customer may have an audit carried out by an independent expert bound by confidentiality. The parties agree on the timing and scope in advance, so that the business operations of VYS are not disrupted unnecessarily. The costs are borne by the customer.

Article 13. After the end: return and deletion

13.1 After the end of the agreement, VYS deletes the personal data it processes for the customer within 30 days, or returns it at the customer's request, unless a legal obligation requires VYS to keep it longer.

13.2 Copies in backups disappear when those backups are overwritten in the regular cycle. Until then, they remain secured and are not used.

Article 14. Liability

14.1 The liability article in the terms and conditions applies to liability under this agreement.

Article 15. Final provisions

15.1 In case of a conflict about the processing of personal data, this agreement prevails over the terms and conditions.

15.2 VYS announces changes to this agreement at least 1 month in advance, as set out in the terms and conditions.

15.3 This agreement is governed by Dutch law. Disputes are submitted to the District Court of North Holland (rechtbank Noord-Holland), Alkmaar location.

15.4 This agreement is available in Dutch and English. In case of a difference between the two, the Dutch version prevails.

15.5 Questions about this agreement or a notification can be sent to info@vysscheduling.nl or by phone at +31(0)85-4013599.