BelBuddy Data Processing Agreement

Annex to the BelBuddy Terms and Conditions · version 25 October 2026 (draft). This agreement is still being reviewed by a lawyer; we will email any new version.

Parties

1. The Customer, as stated at sign-up or in the offer, hereinafter the "Controller";
2. Wenneker Ventures, trading as BelBuddy, based in The Hague, Chamber of Commerce (KvK) 42173073, hereinafter the "Processor".

The Customer uses the BelBuddy phone assistant. In doing so, BelBuddy processes personal data of callers and of the Customer's staff. In this agreement the parties set out how this is done, as required by Article 28 of the General Data Protection Regulation (GDPR).

Article 1 — Subject and term

1. The Processor processes personal data only on behalf of the Controller and only to provide the Service as described in the Terms and Conditions and in Annex 1.
2. This agreement runs for as long as the Agreement runs and thereafter for as long as the Processor still processes personal data of the Controller.

Article 2 — Instructions

1. The Processor processes the personal data only on documented instructions from the Controller. The settings the Customer chooses in the app (such as retention period, integrations, notifications and the message to callers) count as such instructions.
2. The Processor does not process personal data for its own purposes, does not sell it, and does not use it for advertising or to train its own models.
3. If the Processor believes an instruction infringes the GDPR, it informs the Controller immediately.
4. If the Processor is legally required to process or disclose data (for example by order of a competent authority), it informs the Controller in advance, unless the law prohibits this.

Article 3 — Confidentiality

1. Everyone who has access to the personal data on behalf of the Processor is bound by confidentiality.
2. The Processor only gives access to persons who need it to provide, manage or restore the Service.

Article 4 — Security

1. The Processor takes appropriate technical and organisational measures to secure the personal data. The measures are listed in Annex 3.
2. The Processor may change the measures, provided the level of security does not decrease.

Article 5 — Sub-processors

1. The Controller gives general authorisation for the sub-processors listed in Annex 2.
2. The Processor announces a new or replacement sub-processor by email at least 30 days in advance. The Controller may object on reasonable grounds within that period. If the parties cannot agree, the Controller may cancel the Agreement with effect from the date the change takes effect.
3. The Processor imposes on each sub-processor at least the same obligations as in this agreement and remains responsible to the Controller for their performance.
4. Systems the Controller connects itself (such as its own calendar, ticketing system or CRM) are not sub-processors of the Processor. The Processor sends data there on the Controller's instructions.

Article 6 — Transfers outside the EEA

1. The Processor only transfers personal data to countries outside the European Economic Area if there is a valid legal basis, such as an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
2. Annex 2 states, per sub-processor, where data is processed and on what basis.

Article 7 — Data subject rights

1. The Processor helps the Controller, as far as reasonably possible, to respond to requests from data subjects (access, rectification, erasure, restriction, portability and objection). In the app the Customer can view and export calls; the Processor handles deletion on request within 14 days of a request from the Customer.
2. If a data subject's request reaches the Processor directly, the Processor forwards it to the Controller and does not handle it itself, unless the Customer asks it to.

Article 8 — Personal data breaches

1. The Processor notifies the Controller of a personal data breach without undue delay, and no later than 48 hours after discovering it.
2. The notification includes, as far as known: what happened, which data and how many data subjects are affected, the likely consequences, and the measures taken or to be taken.
3. The Controller decides whether to notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and data subjects. The Processor assists.

Article 9 — Assistance

Taking into account the nature of the processing and the information available, the Processor assists the Controller with a data protection impact assessment (DPIA) and any prior consultation with the supervisory authority.

Article 10 — Audits

1. The Processor makes available all information needed to demonstrate compliance with this agreement.
2. The Controller may have this checked once a year, or after a data breach, by an independent expert bound by confidentiality, with at least 30 days' notice. The Controller bears the cost of the audit, unless it shows that the Processor materially fails to comply with this agreement.

Article 11 — Retention and deletion

1. Calls are kept for the period the Customer has set in the app (30 days to 2 years; default 1 year). After that, the Service deletes them automatically every night.
2. After the Agreement ends, the Processor deletes the Controller's personal data within 30 days. Encrypted backups still containing that data are deleted according to the backup schedule (on the server after 30 days; in the encrypted backup mailbox at the monthly clean-up, at the latest after 60 days) and are not used until then, except to restore after an outage.
3. Before the end, the Customer can export its calls as CSV in the app.
4. Any statutory retention obligation of the Processor takes precedence.

Article 12 — Liability

Article 10 of the Terms and Conditions applies to the liability of the parties, insofar as the law permits.

Article 13 — Final provisions

1. In case of conflict, this Data Processing Agreement prevails over the Terms and Conditions as far as the processing of personal data is concerned.
2. This agreement is governed by Dutch law. Disputes are submitted to the District Court of The Hague.

Annex 1 — Description of the processing

Annex 2 — Sub-processors

Telegram is only used for outage alerts to BelBuddy itself and for the chat on BelBuddy's own website (questions from visitors, not from the Customer's callers). No calls or caller data of the Customer go through Telegram.

Annex 3 — Security measures

• Connections: all connections use https (TLS). Webhooks to the Customer are signed.
• Access: sign-in with a one-time code by email, with Microsoft or with Google. Each Customer only sees its own data. Roles (owner and staff); only an owner can export.
• Secrets: passwords and keys for integrations (such as calendar app passwords and API keys) are stored encrypted (AES-GCM). The key is kept separately from the database.
• Calendars: access to the calendar only (Google: events only), not to email, contacts or files.
• Backups: an encrypted backup every night; an encrypted copy off the server. Backups cannot be opened without the key.
• Retention: automatic deletion according to the Customer's retention period.
• Monitoring: an automatic check of the service every 5 minutes, with an alert to BelBuddy in case of an outage.
• Changes: every new version is tested first, with a backup before and after.
• Server: only the necessary ports open; administration through a secured management environment.