Data processing agreement

Your data, in good hands.

If we build something that works with personal data from your business, such as names and email addresses of your customers, we process that data on your behalf. This agreement applies to that, as the GDPR (Article 28) requires. It comes with the proposal: by accepting the proposal, you also accept this agreement.

Version 26 October 2026

1. 1

   Who is who

   Your business is the controller: you decide what the data is used for. PA Agency B.V., trading as PA Automations, is the processor: we process the data only for you. Anything not covered here is governed by the proposal and our terms of service. Where privacy is concerned, this agreement takes precedence.

2. 2

   Which data and what for

   The proposal states what the automation does. That determines which data we process, such as names, email addresses, phone numbers, addresses and the content of messages, quotes and invoices, and whose: usually your customers, suppliers and staff. We use it only to build, test and run the automation. We only process special categories of personal data, such as health data, or national identification numbers if this is explicitly stated in the proposal.

3. 3

   Only on your instructions

   We process the data only according to your instructions: the proposal and anything you later ask us in writing. If the law requires us to do otherwise, we'll tell you beforehand, unless the law prohibits that. If we believe an instruction breaches the GDPR, we'll tell you straight away.

4. 4

   Confidentiality

   Only people who really need the data for the work can access it. Everyone who works for us is bound to confidentiality, also afterwards.

5. 5

   Security

   We secure the data appropriately for the risk, as the GDPR requires (Article 32). Among other things: servers in the European Union, encrypted connections, sign-in only with keys or strong passwords and a second step where possible, access only for those who need it, automatic security updates and keeping no more data than necessary.

6. 6

   Parties we engage

   We only engage parties we need and who keep to the same commitments. Currently these are netcup GmbH (our servers, in Nuremberg, Germany) and Amazon Web Services EMEA SARL (the AI service, via Amazon Bedrock in data centres in the European Union). We tell you about a new party at least 14 days in advance. If you have a well-founded objection, we look for a solution together, and if that doesn't work, you may stop the assignment. Software in your company's name, such as your accounting package, isn't part of this: you have your own agreement with those suppliers.

7. 7

   In the European Union

   We process the data in the European Union. If it ever needs to happen outside the EU, then only with your permission and with the safeguards the GDPR requires, such as the European Commission's standard contractual clauses.

8. 8

   Rights of people in your data

   If someone asks you for access to, correction or deletion of their data, we help you with it. If such a request reaches us, we forward it to you straight away.

9. 9

   Data breaches

   If we discover a breach involving your data, we report it to you within 48 hours, with what we know at that point: what happened, which data and which people are affected, and what we're doing to fix it. You decide whether it needs to be reported to the supervisory authority or to the people concerned; we help you with that.

10. 10

    Help with your own obligations

    If you need to carry out a risk assessment (DPIA) or the supervisory authority asks you something, we help with the information we have. If that takes more than a few hours of work, we agree a fixed price beforehand.

11. 11

    Audits

    We give you all the information you need to show that these commitments are being met. If you want an independent expert to carry out an audit, that's possible by arrangement, at most once a year and at your cost, unless it turns out we didn't keep to the agreement.

12. 12

    Retention and deletion

    We keep the data no longer than needed for the assignment. When our work together ends, you get your data within 10 working days and we delete it 30 days after the end date, also at the parties we engage, unless the law requires us to keep something longer.

13. 13

    Liability

    The liability arrangements and limits in our terms of service apply.

14. 14

    Duration and law

    This agreement runs for as long as we process data for you. The commitments on confidentiality and deletion also apply afterwards. This agreement is governed by Dutch law.

PA Automations is a trade name of PA Agency B.V. · Chamber of Commerce 99602199 · info@perfectautomations.nl