Data processing agreement

What is a DPA? A DPA records agreements about data. Simply put: how do we deal with data? Sounds heavy. Isn’t it. Simply read along. Below are the usual agreements. A data processing agreement (also called DPA, Data Processing Agreement) records how Altena Digital processes a client’s personal data when commissioned, for example with custom software, SaaS platforms or hosting of applications in which user data is stored.

This page shows the standard provisions of Altena Digital’s processing agreement. A signed copy is prepared for specific tasks in which personal data are processed on the basis of the model below. Adjustments can be discussed at the client’s request.

1. Parties and definitions

This data processing agreement shall apply between:

• Controller: the client who provides Altena Digital with a contract in which personal data are processed.
• Processor: Altena Software Development & IT Management, acting as Altena Digital (KvK 98829106).

The concepts used are in line with the definitions in the General Data Protection Regulation (GDPR, EU 2016/679).

2. Purpose and nature of processing

Altena Digital only processes personal data necessary for the performance of the agreed assignment. The nature of the processing, the type of personal data and the categories of persons concerned are specified in the corresponding project agreement.

Processing takes place within the European Economic Area (EEA), unless otherwise agreed in advance in writing.

3. Obligations of the processor

Altena Digital:

• Processes personal data solely on the basis of written instructions from the controller;
• Ensures that persons having access to the data ensure confidentiality;
• Takes appropriate technical and organisational measures to secure the data;
• Supports the controller in requests from data subjects (inspection, correction, removal);
• Report data leaks without undue delay, and in any case within 48 hours of discovery;
• Provides co-operation in audits taking into account a reasonable prior notice.

4. Security Measures

Altena Digital uses the following security measures by default:

• Encrypted communication (HTTPS/TLS) between all systems;
• Encryption of sensitive data in case of storage where applicable;
• Multi-factor authentication for administrative access;
• Roll-based access control and the need-to-know principle;
• Logging of administrative operations for traceability;
• Regular security updates and independent audits;
• Automated retention policy backups;
• Monitoring and alerting for suspicious activity.

5. Subprocessors

Sub-processors may be enabled to perform certain services, e.g. cloud hosting, transactional email or monitoring. Current sub-processors are shared in writing upon request.

The engagement of a new sub-processor is notified to the controller in advance. The controller has the right to object in writing on compelling grounds.

6. Transfer outside the EEA

Personal data are not in principle transferred to countries outside the EEA. If this is necessary for a specific service, this will only be done under the appropriate safeguards provided for in Article 46 GDPR (such as Standard Contractual Clauses).

7. Data leaks

In the event of a suspected or confirmed personal data breach, the controller is informed immediately, with at least the following information:

• The nature and extent of the leak;
• The categories of persons and data concerned;
• The likely consequences;
• Measures taken or proposed.

The controller shall be responsible for any notification to the Dutch Data Protection Authority and/or data subjects.

8. Storage period and return

Personal data shall be retained as long as the processing agreement is in force and the data necessary for its execution. Upon termination, the data shall be returned, migrated or destroyed at the discretion of the controller, unless there is a statutory retention obligation.

9. Liability

The liability of Altena Digital under this data processing agreement is in line with the liability provisions in the general terms and conditions and is limited to the amount invoiced in the relevant project in the three months preceding the event causing the damage.

10. Applicable law and disputes

This data processing agreement is governed by Dutch law. Disputes should preferably be resolved by mutual agreement. If the parties cannot reach an agreement, the dispute will be submitted to the competent court in the district where Altena Digital is established.

Apply for processing agreement

For a specific project, the above provisions are set out in a signed document. A signed copy can be requested via info@altena.digital, preferably with a brief description of the type of data and the intended use.

Last updated: May 2026