This data processing agreement is an annex to and part of the General Terms and Conditions of Studio Renders B.V. It applies whenever Studio Renders B.V. processes personal data on behalf of the Client in the course of carrying out an assignment. In that case, the Client is the controller and Studio Renders B.V. is the processor within the meaning of the General Data Protection Regulation (GDPR).
1. Definitions
The terms from the GDPR have the same meaning in this data processing agreement. Processor refers to Studio Renders B.V., and Controller refers to the Client. The other terms align with the General Terms and Conditions.
2. Subject matter, nature and purpose of the processing
The Processor processes personal data solely to carry out the agreed assignment, such as creating visualisations, renders and related services, and the communication and administration that go with them. The Processor does not use the personal data for its own purposes.
3. Types of personal data and categories of data subjects
This generally concerns contact details such as name, job title, e-mail address and telephone number, and data that the Client supplies for the assignment, for example in floor plans, photos or reference material. Data subjects are in particular the contact persons and employees of the Client and, where applicable, the Client’s customers. Special categories of personal data are not knowingly processed; the Controller does not supply these unless otherwise agreed in writing in advance.
4. Instructions of the Controller
The Processor processes the personal data solely on the basis of written instructions from the Controller, including this data processing agreement and the assignment itself, unless a legal obligation provides otherwise. If the Processor considers that an instruction infringes the GDPR or other privacy legislation, it will report this.
5. Confidentiality
The Processor keeps the personal data confidential and obliges everyone it involves in the processing to the same confidentiality.
6. Security
The Processor takes appropriate technical and organisational measures to protect the personal data against loss and against unlawful processing, in line with Article 32 GDPR. These include, among other things, encrypted connections, access limited to authorised persons, strong authentication and regular back-ups. The level of protection is tailored to the nature of the data and the risks of the processing.
7. Sub-processors and transfer
The Controller grants the Processor general authorisation to engage sub-processors. The Processor imposes on each sub-processor the same obligations as in this agreement and remains answerable for their actions. At present, the Processor engages the following sub-processors:
- WeFact (Netherlands): invoicing and financial administration;
- Mailchimp / Intuit (United States): sending the newsletter;
- Miro (United States): project collaboration and sharing designs;
- Hostinger (European Union): web hosting and storage.
For transfers to a country outside the European Economic Area, as with Mailchimp and Miro, the Processor ensures a valid basis under Article 46 GDPR, namely the EU-US Data Privacy Framework and/or the standard contractual clauses of the European Commission. If the Processor wishes to replace a sub-processor, it will inform the Controller in advance, who may object to this.
8. Rights of data subjects
If the Processor receives a request from a data subject for access to, correction, erasure or transfer of data, it forwards this to the Controller and does not handle it itself, unless otherwise agreed. The Processor reasonably assists the Controller in handling such requests and in meeting its obligations under the GDPR.
9. Data breaches
As soon as the Processor discovers a breach in connection with personal data, it reports this without undue delay to the Controller, with the information the Controller needs to comply with its notification obligation (Articles 33 and 34 GDPR). The Controller assesses whether a notification to the supervisory authority and to the data subjects is necessary.
10. Monitoring and audits
On request, the Processor makes available to the Controller the information needed to demonstrate that the obligations under this agreement are being met, and enables audits. The parties agree in advance on the manner, the frequency and the reasonable costs thereof.
11. Duration, termination and return
This data processing agreement applies for as long as the Processor processes personal data on behalf of the Controller within the framework of an assignment. After the assignment ends, the Processor erases the personal data or returns it, at the Controller’s choice, unless a statutory retention obligation provides otherwise. Data that the Processor retains as an independent controller, for example for its financial administration, falls outside this return obligation.
12. Liability
The liability provisions of the General Terms and Conditions apply to this data processing agreement. Liability for damage relating to the processing of personal data is assessed with due regard to Article 82 GDPR.
13. Final provisions
This data processing agreement is governed by Dutch law. Where it deviates from the General Terms and Conditions as regards the processing of personal data, this data processing agreement prevails. You can ask questions via contact@studiorenders.nl.