Addendum A — Data processing

Visionhost International B.V. processes personal data only insofar as necessary during or in connection with the performance of the agreement concluded between the parties. The processing of personal data by Visionhost International B.V. takes place in a proper and careful manner, in accordance with privacy legislation and in accordance with the client’s request for services.

Visionhost International B.V. is entitled to engage sub-processors in the processing of the personal data, provided that Visionhost International B.V. ensures that the sub-processors to be engaged assume at least the same obligations as those resting on Visionhost International B.V. on the basis of this Addendum. In this relationship, Visionhost International B.V. remains the point of contact for the client.

Visionhost International B.V. will only transfer personal data to a country outside the European Economic Area provided that country guarantees an adequate level of protection and it complies with the other obligations resting on it on the basis of this Addendum and privacy legislation. If the client transfers personal data to countries outside the European Union by means of the services, the client indemnifies Visionhost International B.V. against all legal claims of third parties based on the assertion that this personal data is transferred in breach of the provisions of the GDPR.

Visionhost International B.V. takes appropriate technical and organisational measures to secure personal data against loss and against any form of unlawful processing. These measures guarantee, taking into account the state of the art and the costs of implementation, an appropriate level of security in view of the risks of the processing and the nature, scope and context of the personal data to be protected.

Visionhost International B.V. will inform the client without delay after it has become aware of a data breach. The notification contains a description of:

• i. the data breach;
• ii. the nature of the breach (including copying, alteration, deletion, theft, unknown);
• iii. when the data breach took place;
• iv. the number of persons whose personal data may be involved in the data breach;
• v. the type of personal data (including name and address details, citizen service numbers, telephone numbers, e-mail addresses, access or identification data, financial data); and
• vi. the technical measures taken by Visionhost International B.V. to stop the breach and prevent future breaches.

At the client’s request, Visionhost International B.V. provides further information about the data breach, insofar as necessary for the client to comply with its statutory obligations regarding notification to the Dutch Data Protection Authority and data subjects. The client is obliged to actively assist Visionhost International B.V. in the event of a data breach and the resulting notification obligation of Visionhost International B.V. to the Dutch Data Protection Authority under the Telecommunications Act.

In the event of a request for access, rectification, erasure or restriction of processing, Visionhost International B.V. cooperates by providing, as soon as possible but no later than within twenty working days after the client requests Visionhost International B.V. to do so, all information that the client needs to comply with the request, or by rectifying, erasing or shielding the personal data indicated by the client, insofar as the client does not have independent access to this data from the services of Visionhost International B.V.

Visionhost International B.V. makes a back-up copy of all server data, which may also contain personal data, at least once a day.

Visionhost International B.V. undertakes, unconditionally and irrevocably, to maintain confidentiality during and after termination of this agreement regarding all personal data whose confidential nature it knows or can reasonably suspect. Visionhost International B.V. guarantees that all its employees who have access to personal data are bound by the confidentiality obligation described in this article and refrain from copying, passing on, transferring or otherwise disseminating personal data to third parties. This obligation does not apply only if and insofar as disclosure is required on the basis of the law and/or a court ruling, in which case the information to be disclosed will be kept as limited as possible.

The obligations of Visionhost International B.V. under this Addendum continue unabated after termination of the agreement as well, if and insofar as Visionhost International B.V. still has access to personal data. Upon termination of the agreement, the client is itself responsible for exporting personal data. Immediately, or at the latest thirty (30) days after termination or dissolution, Visionhost International B.V. will destroy the personal data provided to it. Visionhost International B.V. may deviate from this insofar as a statutory retention period applies to it in respect of certain personal data, or insofar as this is necessary to prove the fulfilment of its obligations towards the client.

The names and terms in this Addendum that are written with a capital letter have the following meaning:

Data breach(es): a breach in connection with personal data, i.e. any breach of security that accidentally or unlawfully leads to the destruction, loss, alteration or unauthorised disclosure of, or unauthorised access to, data transmitted, stored or otherwise processed;

Data subject(s): the person to whom a personal data item relates;

Processor: Visionhost International B.V., being the (legal) person who processes personal data on behalf of the controller;

Agreement: the agreement concluded between the parties regarding the service provision of Visionhost International B.V. to the client, of which this Addendum forms an annex;

Parties: Visionhost International B.V. and the client, jointly;

Personal data: all information about an identified or identifiable natural person;

Privacy legislation: all applicable laws and regulations on the processing of personal data — including but not limited to — the General Data Protection Regulation;

Sub-processor: the (legal) person who in turn processes personal data on behalf of Visionhost International B.V.;

Controller(s): the client, being the (legal) person who (alone or together with others) determines the purpose of and means for the processing of personal data and is obliged, on the basis of privacy legislation, to take the safeguards required for that processing;

Processing: an operation or a set of operations relating to personal data or a set of personal data, whether or not carried out by automated means, such as collecting, recording, organising, structuring, storing, updating or modifying, retrieving, consulting, using, providing by means of transmission, distributing or otherwise making available, aligning or combining, shielding, erasing or destroying data.