Skip to content
Vendorfy home
NLEN

Data processing agreement

Version 1.0, last updated on 5 November 2026

This is a translation. If the Dutch and English versions differ, the Dutch version prevails.

This data processing agreement belongs to the Vendorfy terms and conditions. It applies to every engagement in which Vendorfy processes personal data on behalf of the customer. If the customer also wants to sign it, that is possible on request.

Parties: the customer, as controller, and Vendorfy, a trade name of SecMads, registered with the Dutch Chamber of Commerce (KvK) under number 97694398, as processor.

1. Definitions

1.1 Terms such as personal data, processing, controller, processor, data subject and personal data breach (data breach) have the meaning given to them in the General Data Protection Regulation (GDPR).

1.2 Subprocessor: a party that Vendorfy engages to process personal data for the engagement.

1.3 Other capitalised terms have the meaning given in the Vendorfy terms and conditions.

2. Subject and duration

2.1 Vendorfy processes personal data on behalf of the customer to carry out the engagement. Annex 1 describes which data, about whom, for what purpose and for how long.

2.2 This agreement applies for as long as Vendorfy processes personal data for the customer, including after the engagement has ended.

3. The customer's instructions

3.1 Vendorfy processes the personal data only on the customer's written instructions. The engagement, the terms and conditions, this agreement and instructions by email count as written instructions.

3.2 If Vendorfy believes an instruction conflicts with the GDPR, it informs the customer straight away.

3.3 If Vendorfy must process data because the law requires it, it informs the customer in advance, unless the law prohibits this.

4. Confidentiality

Vendorfy and everyone with access to the personal data on Vendorfy's behalf are bound by confidentiality. Access is limited to those who need it for the engagement.

5. Security

5.1 Vendorfy takes appropriate technical and organisational measures to protect the personal data, as referred to in Article 32 GDPR. Annex 2 describes these measures.

5.2 Vendorfy may adjust the measures, provided the level of protection does not decrease.

6. Subprocessors

6.1 The customer gives Vendorfy general authorisation to engage subprocessors. Annex 3 lists the subprocessors Vendorfy currently uses.

6.2 Vendorfy announces a new subprocessor at least 30 days before engaging it. The customer may object with reasons within that period. If the parties cannot find a solution, the customer may terminate the part of the engagement that requires the subprocessor.

6.3 Vendorfy imposes at least the same obligations on subprocessors as set out in this agreement and remains responsible to the customer for their work.

7. Transfers outside the EEA

Vendorfy transfers personal data to a country outside the European Economic Area only where an appropriate safeguard applies, such as an adequacy decision of the European Commission (including the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

8. Data subject rights

8.1 If Vendorfy receives a request from a data subject, for example for access or deletion, it forwards it to the customer as soon as possible. The customer handles the request.

8.2 Vendorfy assists the customer where reasonable in meeting such requests.

9. Data breaches

9.1 If Vendorfy discovers a data breach affecting the customer's personal data, it reports this to the customer without undue delay, and where possible within 48 hours of discovery.

9.2 Vendorfy provides the information it has: what happened, which data and data subjects are affected, the likely consequences and the measures it has taken or proposes. If information is still missing, Vendorfy adds it as soon as it becomes available.

9.3 The customer decides whether the data breach is reported to the supervisory authority or to data subjects. Vendorfy does not report a customer's data breach itself, unless the customer asks it to.

10. Assistance

Vendorfy assists the customer where reasonable with a data protection impact assessment (DPIA) or prior consultation of the supervisory authority, as far as Vendorfy's processing is concerned. If this takes more than a few hours, Vendorfy may charge reasonable costs after consulting the customer.

11. Verification

11.1 On request, Vendorfy gives the customer the information needed to demonstrate that it complies with this agreement, for example by completing a questionnaire.

11.2 If that is not sufficient, the customer may have an audit carried out at most once a year by an independent expert bound by confidentiality. The customer announces the audit at least 30 days in advance and bears the costs. An audit may not unnecessarily disrupt work for other customers.

12. AI

12.1 Vendorfy does not use the customer's personal data to train or improve AI models.

12.2 Vendorfy uses AI services only on business terms under which the provider does not use submitted data to train its own models.

12.3 Vendorfy makes no decisions about data subjects based solely on automated processing. Every assessment is reviewed and signed by a security expert.

13. Return and deletion

13.1 Vendorfy keeps the assessment file for up to 12 months after the end of the engagement or annual programme, so the customer can use it with the regulator or an auditor. After that, Vendorfy deletes the personal data.

13.2 The customer may ask at any time for the data to be deleted earlier or returned. Vendorfy confirms deletion in writing.

13.3 Vendorfy may keep data longer where the law requires it. This agreement continues to apply to that data.

14. Liability

Vendorfy's liability under this agreement is governed by article 14 of the Vendorfy terms and conditions, unless the GDPR requires otherwise.

15. Final provisions

15.1 If this agreement conflicts with the terms and conditions, this agreement prevails as far as the processing of personal data is concerned.

15.2 Vendorfy may amend this agreement, for example when the law changes. Vendorfy does not make changes that reduce the protection of personal data without the customer's consent.

15.3 This agreement is governed by Dutch law. Disputes are submitted to the competent court in Amsterdam (Rechtbank Amsterdam).

Annex 1. Description of the processing

  • Purpose: carrying out supplier assessments and the annual programme: requesting and following up evidence from suppliers, keeping the supplier register up to date and preparing reports.
  • Data subjects: contact persons at the customer's suppliers, the customer's employees involved in the engagement (such as the owner of a supplier contract) and people named in evidence documents (such as signatories of an audit report).
  • Personal data: name, role, business email address, business phone number, correspondence and names appearing in evidence documents.
  • Special categories of personal data: none. The customer does not send special categories of personal data, criminal records data or identification numbers.
  • Nature of the processing: receiving, storing, consulting, analysing (including with AI), summarising in reports, sending emails and deleting.
  • Retention period: see article 13.
  • Location: within the EEA, except for the subprocessors in Annex 3 that process outside the EEA.

Annex 2. Security measures

  • Two-factor authentication on all accounts holding customer personal data.
  • Encryption of data in transit and at rest.
  • A separate, restricted folder per customer; only the security expert carrying out the engagement has access.
  • Work devices with disk encryption, automatic screen lock and up-to-date software.
  • Logging of access and changes through Google Workspace.
  • Personal data is deleted in line with article 13.

Annex 3. Subprocessors

  • Google (Google Workspace): email, document storage and calendar. Location: EEA and United States. Safeguard: EU-US Data Privacy Framework and standard contractual clauses.
  • Anthropic (Claude): AI for research and preparing reports. Location: United States. Safeguard: as described in article 7.

This data processing agreement is based on a template by General Legal, PC (general.legal), available under CC0. General Legal has not reviewed this adapted version.