Midflyt data processing agreement

1. Article 1: Parties and roles

1. The customer is the controller. The customer decides which personal data go into the software and for what purpose.
2. Midflyt, based in Tilburg, Chamber of Commerce number 90912721, is the processor. Midflyt only processes the personal data on behalf of the customer.

2. Article 2: Which data, about whom and for what

1. About whom: the customer's users, and people mentioned on a board or in a meeting.
2. Which data: name, email address, role in the software, what users put on cards, in decisions and in minutes, and data about use, such as when someone signs in.
3. For what: providing the software, with the boards, the meetings, the emails and support.
4. Not: special categories of personal data, such as health or criminal records. These do not belong in the software (see article 8 of the terms).

3. Article 3: What Midflyt does

1. Midflyt only processes the data on written instructions from the customer. Using the software counts as that instruction.
2. Midflyt does not use the data for its own purposes, except counts without content or names.
3. Everyone at Midflyt who has access to the data is bound by confidentiality.
4. Midflyt helps the customer with requests from data subjects, such as access or deletion. The software also has functions for this, such as an export of personal data.

4. Article 4: Where the data are stored

1. The data are stored in the Netherlands, at Previder, and do not leave the European Union.
2. Midflyt uses these sub-processors:

3. Midflyt announces a new sub-processor at least 30 days in advance. If the customer has a well-founded reason to object, the customer may cancel free of charge before the new sub-processor starts.
4. Midflyt imposes at least the same obligations on sub-processors as in this agreement.

5. Article 5: Security

1. Midflyt takes appropriate technical and organisational measures to secure the data. These include:
   • an encrypted connection to the software;
   • signing in with a one-time link or a password, and a second step for administrators;
   • permissions per board and per role, so users only see what belongs to them;
   • logging important actions;
   • a backup every night, which is regularly restored as a test.
2. On request, Midflyt provides a description of the security and the statements of the sub-processors.

6. Article 6: Data breaches

1. If Midflyt discovers a data breach involving the customer's personal data, Midflyt reports it as soon as possible, and at the latest within 24 hours.
2. The report states what happened, which data and how many people are involved, what the consequences may be and what Midflyt is doing.
3. The customer decides whether the breach is reported to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and to the data subjects. Midflyt helps with this.

7. Article 7: Audits

1. On request, Midflyt provides the information the customer needs to see that Midflyt complies with this agreement.
2. The customer may have its own audit carried out at most once a year, with at least 30 days' notice and at the customer's expense.

8. Article 8: End

1. When the subscription ends, the customer can view and export everything for 90 days.
2. After that, Midflyt deletes the data. They remain in backups for at most 30 days.

9. Article 9: Liability and term

1. For liability, article 11 of the general terms and conditions applies.
2. This agreement runs for as long as the subscription runs, and after that until all data have been deleted.
3. This agreement is governed by Dutch law. Any dispute will be submitted to the court of Zeeland-West-Brabant (rechtbank Zeeland-West-Brabant).