Data processing agreement

This data processing agreement sets out how WIWO Media, a trade name of CW Nederland B.V., processes personal data on behalf of the Customer when providing its Services. It meets the requirements of Article 28 of the General Data Protection Regulation (GDPR). This data processing agreement forms part of every Agreement between WIWO Media and the Customer and applies because the Customer accepts the terms and conditions (Article 20 of the terms and conditions). No separate signature is required. Capitalised terms have the meaning given to them in the terms and conditions or the GDPR.

This English version is provided for convenience. In case of any discrepancy, the Dutch version prevails.

Article 1. Parties and roles

1.1 The parties to this data processing agreement are:

• the Customer, as controller within the meaning of Article 4(7) GDPR; and
• CW Nederland B.V., trading as WIWO Media, with its registered address at Mina Krusemanstraat 38, 3207 DE Spijkenisse, the Netherlands, registered with the Dutch Chamber of Commerce under number 92544347, as processor within the meaning of Article 4(8) GDPR.

1.2 If the Customer itself acts as a processor for another controller (for example, a web agency that purchases hosting for its own clients), WIWO Media is a sub-processor of the Customer. In that case, the Customer warrants that this data processing agreement is consistent with its arrangements with its own client, and acts as the sole point of contact towards WIWO Media.

1.3 This data processing agreement does not apply to personal data that WIWO Media processes for its own purposes as a controller, such as the Customer's account, contact and billing details. That processing is covered by the privacy policy.

Article 2. Subject matter, nature and purpose of the processing

2.1 This data processing agreement concerns the processing of personal data by WIWO Media on behalf of the Customer, solely to the extent necessary to provide the Services the Customer has ordered.

2.2 Depending on the Service, the processing consists of storing, retaining, transmitting, making available, backing up, restoring, securing, scanning for malware and spam, updating software, providing support during incidents and deleting personal data. For Custom Work and telephony, it also includes configuring and technically processing data in systems built or managed by WIWO Media.

2.3 The sole purpose of the processing is the performance of the Agreement, including delivering, securing, maintaining and supporting the Services. WIWO Media does not process the personal data for its own purposes.

2.4 WIWO Media has no control over the purposes and means of the processing of personal data that the Customer carries out using the Services. The Customer decides which personal data it processes with the Services.

Article 3. Categories of personal data and data subjects

3.1 Depending on the Service ordered, WIWO Media processes the following categories of personal data relating to the following categories of data subjects on behalf of the Customer:

3.2 The Customer decides whether it processes special categories of personal data (Article 9 GDPR), criminal offence data (Article 10 GDPR) or national identification numbers through the Services. If it does, the Customer is responsible for ensuring that this is lawful and that the security measures in Article 7 are appropriate for that data. The Customer will inform WIWO Media if it processes such data on a large scale, so that the parties can discuss additional measures.

Article 4. Duration

4.1 This data processing agreement applies for as long as WIWO Media processes personal data on behalf of the Customer under an Agreement. It ends automatically once all Agreements have ended and WIWO Media has deleted or returned the personal data in accordance with Article 12.

4.2 This data processing agreement cannot be terminated separately from the Agreement.

Article 5. The Customer's instructions

5.1 WIWO Media processes the personal data only on documented instructions from the Customer, including with regard to transfers to a country outside the European Economic Area (EEA), unless required to do so by a legal provision that applies to WIWO Media. In that case, WIWO Media will inform the Customer of that legal requirement before processing, unless the law prohibits such notice.

5.2 The Agreement, this data processing agreement and the settings the Customer selects in the Customer Portal, the Control Panel or the Services constitute the Customer's documented instructions. The Customer gives any additional instructions in Writing.

5.3 If WIWO Media believes that an instruction infringes the GDPR or other data protection rules, it will inform the Customer immediately. WIWO Media may suspend carrying out that instruction until the Customer has confirmed or amended it.

5.4 Instructions that go beyond the standard functioning of the Services and require additional work may be charged as additional work under Article 21 of the terms and conditions, after WIWO Media has provided a cost estimate.

Article 6. Confidentiality

6.1 WIWO Media ensures that everyone acting under its authority who has access to the personal data, such as employees and contractors, is bound by a duty of confidentiality, either by contract or by law.

6.2 WIWO Media does not disclose the personal data to third parties unless the Customer has consented, it is necessary for the performance of the Agreement (for example, through a sub-processor in accordance with Article 8), or WIWO Media is legally required to do so. Where there is a legal obligation, WIWO Media will inform the Customer as soon as possible, to the extent permitted by law.

6.3 WIWO Media staff are given access to personal data only to the extent necessary for their work.

Article 7. Security

7.1 WIWO Media takes appropriate technical and organisational measures to protect the personal data against loss and any form of unlawful processing, as referred to in Article 32 GDPR. In doing so, WIWO Media takes into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to the rights and freedoms of data subjects.

7.2 WIWO Media takes at least the following measures:

• the Services run on servers managed by WIWO Media itself, in data centres within the European Union (Germany);
• customer accounts are strictly isolated from one another on the servers;
• the servers are protected by a firewall and by automatic blocking of repeated failed login attempts (fail2ban);
• hosting accounts are scanned for malware daily;
• the core files of WordPress installations are checked for modifications against the official checksums;
• connections to websites, the Customer Portal and the Control Panel are encrypted using TLS, with free SSL certificates that renew automatically;
• incoming email is filtered for spam and malicious content, and SPF, DKIM and DMARC are supported;
• backups are made daily and stored off-site, separate from the web server;
• the systems are monitored automatically 24 hours a day, 7 days a week;
• access to systems and personal data is restricted to staff who need it for their work, and is revoked when that need ends;
• administrative access uses keys or strong passwords, and two-factor authentication where the systems concerned support it;
• system software is kept up to date and security updates are installed as a priority.

7.3 WIWO Media may adjust these measures, provided the level of security is not reduced as a result.

7.4 The Customer is responsible for securing the components it manages itself, such as its login credentials, its own software, plugins and code, the settings it selects and, for an unmanaged VPS, the operating system and all software on the server (Part D of the terms and conditions). The Customer assesses whether WIWO Media's measures are appropriate for the personal data it processes.

7.5 WIWO Media does not guarantee that its security will be effective under all circumstances. It does ensure a level of security that is appropriate to the risks.

Article 8. Sub-processors

8.1 The Customer gives WIWO Media general authorisation to engage sub-processors for the processing. WIWO Media uses sub-processors in the following categories:

• providers of data centre, server and network capacity in the European Union;
• providers of storage for off-site backups;
• domain name registries and registrars, to the extent they process registrant data;
• providers of telecommunications services for routing telephone traffic;
• providers of AI models, to the extent these are used for support or in AI solutions the Customer has ordered.

8.2 On request, WIWO Media will provide the Customer with an up-to-date list of the sub-processors it engages for the Customer's Services, together with their country of establishment.

8.3 WIWO Media will notify the Customer in advance of any intended addition or replacement of a sub-processor. The Customer may object in Writing, stating its reasons, within 14 days of that notice. The parties will then consult to find a solution. If they cannot agree, the Customer may terminate the Service concerned with effect from the date on which the new sub-processor is engaged, without owing any fee for doing so.

8.4 WIWO Media imposes on each sub-processor, in writing, at least the same data protection obligations as those that apply to WIWO Media under this data processing agreement. WIWO Media remains responsible to the Customer for the sub-processor's performance of those obligations.

Article 9. Transfers outside the European Economic Area

9.1 WIWO Media in principle processes the personal data within the European Economic Area. The servers on which the hosting, email and VPS services run are located in the European Union.

9.2 Personal data is transferred to a country outside the EEA only where an appropriate safeguard under Chapter V GDPR applies, such as an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for participating organisations) or the European Commission's standard contractual clauses, with supplementary measures where necessary. Such transfers may occur when third-party AI models are used for support or in AI solutions.

9.3 WIWO Media limits the personal data used for AI assistance to what is necessary for the purpose, and selects providers and settings under which the data is not used to train models, to the extent the provider makes this possible.

9.4 On request, WIWO Media will tell the Customer to which countries outside the EEA personal data is transferred and which safeguard the transfer relies on.

Article 10. Personal data breaches

10.1 As controller, the Customer is responsible for notifying a personal data breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and, where required, to data subjects.

10.2 To enable the Customer to meet that obligation, WIWO Media will inform the Customer without undue delay, as soon as possible and in any event within 48 hours of discovering a personal data breach affecting the Customer's personal data. WIWO Media sends the notification to the Customer's email address registered in the Customer Portal and, where necessary, also by telephone.

10.3 The notification will in any event state that a breach has occurred. In addition, to the extent known to WIWO Media, it will include:

• the date on which the breach occurred (or, if the exact date is unknown, the period during which it occurred);
• the (suspected) cause of the breach;
• the date and time at which WIWO Media, or a sub-processor engaged by it, became aware of the breach;
• the number of individuals whose data was affected (or, if the exact number is unknown, the minimum and maximum number);
• a description of the group of individuals affected, including the type or types of personal data involved;
• whether the data was encrypted, hashed or otherwise rendered unintelligible or inaccessible to unauthorised persons;
• the measures planned and already taken to stop the breach and to limit its consequences;
• contact details for follow-up on the notification.

10.4 Where not all information is available straight away, WIWO Media will provide it in phases, without further undue delay.

10.5 WIWO Media will immediately take the measures that can reasonably be expected of it to end the breach and limit its consequences, keep the Customer informed of developments, and cooperate in informing the Dutch Data Protection Authority and data subjects where the law requires this.

10.6 WIWO Media documents every breach affecting the Customer's personal data, including the facts, its effects and the remedial action taken.

10.7 WIWO Media will not itself notify the Dutch Data Protection Authority or data subjects of a breach affecting the Customer's personal data, unless the Customer asks it to or the law requires WIWO Media to do so.

Article 11. Assistance to the Customer

11.1 Taking into account the nature of the processing, WIWO Media assists the Customer through appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects, such as requests for access, rectification, erasure, restriction, portability and objection. The Customer can carry out many of these requests itself through the Control Panel, the Customer Portal or the Services.

11.2 If WIWO Media itself receives a request from a data subject concerning personal data it processes on behalf of the Customer, WIWO Media will forward the request to the Customer without delay. The Customer handles the request itself. WIWO Media will not respond to the substance of the request unless the Customer asks it to.

11.3 WIWO Media assists the Customer in meeting its obligations under Articles 32 to 36 GDPR, such as carrying out a data protection impact assessment (DPIA) and any prior consultation with the Dutch Data Protection Authority, taking into account the nature of the processing and the information available to WIWO Media.

11.4 WIWO Media may charge the reasonable costs of assistance under this article at its applicable hourly rate, after providing a cost estimate. Assistance required because of a failure on WIWO Media's part is not charged.

Article 12. End of processing: deletion or return

12.1 When a Service ends, WIWO Media will delete the personal data it processed on behalf of the Customer for that Service, or return it to the Customer, at the Customer's choice. Until the Service ends, the Customer can export its data itself through the Control Panel, the Customer Portal or the Service. If the Customer wants WIWO Media to return the data, it must say so in Writing before the Service ends. WIWO Media may charge reasonable costs for returning the data.

12.2 Copies of the personal data in backups are deleted in the normal backup rotation, no later than 30 days after the Service ends, as set out in Article 15.5 of the terms and conditions. Until then, the obligations under this data processing agreement continue to apply to those copies.

12.3 WIWO Media will retain personal data for longer where a legal provision requires it to do so. In that case, this data processing agreement continues to apply and the data is retained solely for that legal purpose.

12.4 On request, WIWO Media will confirm in Writing that the personal data has been deleted.

Article 13. Information and audits

13.1 On request, WIWO Media will make available to the Customer all information reasonably necessary to demonstrate compliance with its obligations under Article 28 GDPR and this data processing agreement, such as a description of its security measures.

13.2 If the Customer considers the information provided insufficient, it may have an audit carried out by an independent, qualified third party bound by confidentiality. An audit may take place no more than once per calendar year, unless there has been a personal data breach or there is a specific, substantiated suspicion that WIWO Media is not complying with this data processing agreement.

13.3 The Customer must announce an audit in Writing at least two weeks in advance, describing its scope. In the event of a breach or a specific suspicion, that period may be shortened to the shortest period that is reasonable. The parties will agree on the timing and approach in good faith. The audit will be carried out in a way that does not disrupt WIWO Media's operations or compromise the confidentiality and security of other customers' data.

13.4 The costs of the audit, including WIWO Media's reasonable internal costs, are borne by the Customer, unless the audit shows that WIWO Media is in material breach of this data processing agreement. In that case, WIWO Media bears its own costs and remedies the breach as quickly as possible.

13.5 The Customer will share the audit findings with WIWO Media. The findings are confidential.

Article 14. The Customer's obligations

14.1 The Customer warrants that it processes the personal data lawfully, that it has a valid legal basis for the processing and that it informs data subjects as required by the GDPR.

14.2 The Customer warrants that the content, the use and the instruction to process the personal data are not unlawful and do not infringe the rights of third parties.

14.3 The Customer indemnifies WIWO Media against claims by third parties, including data subjects and supervisory authorities, arising from a breach by the Customer of the GDPR or of this data processing agreement.

Article 15. Liability

15.1 The parties' liability in connection with this data processing agreement is governed by Article 16 of the terms and conditions, except where the GDPR mandatorily provides otherwise.

15.2 Article 82 GDPR continues to apply in full in the relationship between the parties and data subjects.

Article 16. Order of precedence and final provisions

16.1 In the event of a conflict between this data processing agreement and the terms and conditions, this data processing agreement prevails to the extent the matter concerns the processing of personal data. Additional written arrangements on data protection between WIWO Media and the Customer prevail over this data processing agreement.

16.2 WIWO Media may amend this data processing agreement in accordance with Article 22 of the terms and conditions. An amendment will never reduce the level of protection required by the GDPR.

16.3 This data processing agreement is governed by Dutch law. Article 25 of the terms and conditions applies to disputes.

16.4 The Customer can send questions about this data processing agreement to privacy@wiwomedia.nl.