Data processing agreement
This is an English translation of our Verwerkersovereenkomst. If the two versions differ, the Dutch version prevails.
This data processing agreement belongs to the terms and conditions and applies when an agency (“controller”) uses Analyty AI through White Label for its own clients. The agency accepts this agreement by taking out White Label. Velian AI, trading as Analyty AI, registered with the Dutch Chamber of Commerce (KVK) under number 97486779, VAT number NL005273222B71 is the “processor”.
1. Subject and duration
The processor only processes personal data on behalf of the controller, to provide the White Label service. This agreement runs as long as the White Label plan runs, and after that until all personal data has been deleted or returned.
2. Which data and whose
| Data subjects | Users of client environments (employees of the agency's clients) and employees of the agency itself |
|---|---|
| Personal data | Name, email address, company name, password hash, usage data, and the data in the client environment: websites, prompts, scan results and (if a Meta account is connected) advertising statistics |
| Nature and purpose | Storing, analysing and showing data in the client environments, running GEO scans and generating AI advice |
| Special categories of data | Not intended. The controller does not enter special categories of personal data. |
3. Instructions
The processor follows the documented instructions of the controller. Those instructions are set out in this agreement and in how the agency uses the service. If, in the processor's view, an instruction breaches the GDPR, the processor reports this immediately. The processor does not use the data for its own purposes.
4. Confidentiality
Everyone at the processor who has access to the personal data is bound by confidentiality.
5. Security
The processor takes appropriate technical and organisational measures, including:
- encrypted connections (HTTPS);
- passwords only stored as a hash, Meta tokens encrypted (AES-256);
- logical separation between agencies and between client environments, with authorisation per role;
- access to production systems only for those who need it;
- limits on the number of requests, against misuse.
6. Sub-processors
The controller gives general permission for the sub-processors listed in the privacy policy. The processor imposes the same obligations on them as in this agreement. The processor announces new or replacement sub-processors at least 30 days in advance. The controller may object to this on reasonable grounds and, if no solution is found, cancel the plan.
7. Transfers outside the EEA
Transfers to countries outside the EEA only take place with appropriate safeguards: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
8. Rights of data subjects
The processor helps the controller, as far as reasonable, with requests from data subjects, such as access or erasure. If such a request reaches the processor directly, the processor forwards it.
9. Data breaches
If the processor discovers a security breach affecting the personal data, the processor reports it to the controller without undue delay and no later than 48 hours after discovery. The report contains all information the controller needs to meet its own notification obligation.
10. Audit
The processor makes available the information needed to demonstrate compliance with this agreement, and cooperates with a reasonable audit. Such an audit is announced at least 30 days in advance and is at the controller's expense.
11. End of the agreement
If the White Label plan ends, the processor deletes the personal data of the client environments within 30 days, unless the law requires longer retention. On request, the controller first gets the data back in a common format.
12. Liability
The liability arrangement from the terms and conditions applies.
Do you need a signed version, or do you want to use your own data processing agreement? Email liamharinga.work@gmail.com.