Data processing agreement

This is the data processing agreement referred to in article 28(3) of the General Data Protection Regulation (GDPR), between the organisation that takes out a DynBrowser subscription (“you”) and DynSolutionZ B.V. (“we”). It is an annex to the licence and subscription terms and forms one agreement with them. Where it conflicts with any other document, this agreement prevails in everything concerning the processing of personal data.

1. Roles

For the processing that article 3 marks as processor processing, you are the controller: you determine why and how that personal data is processed, and we process it solely on your behalf. That is your customer content (article 12 of the licence terms), the administration of your users, their rights and settings, and support requests.

For a limited number of purposes we determine the purposes and means ourselves and are therefore a controller in our own right: checking and enforcing the licence and the number of seats; the security of our systems and the prevention of misuse; error reports and usage statistics to keep the product working and improve it; anonymous arcade statistics; and our own customer administration — contact details, quotes, invoices and payments. For those, our privacy statement applies instead of this agreement.

2. Subject, nature, purpose and duration

As processor we process personal data solely to provide DynBrowser and the associated online services to you: the customer portal, the administration of users and rights, the server-side features in article 12 of the licence terms, and support. The processing consists of collecting, storing, consulting, transmitting, correcting and deleting.

This agreement runs for as long as your subscription runs, and afterwards for as long as we still hold personal data of yours as processor, until article 11 has been carried out in full.

3. Data subjects and personal data

Data subjects are the people within your organisation who use DynBrowser or the customer portal, and the contact persons you register with us. The categories of personal data, and our role for each, are:

We do not process special categories of personal data as referred to in article 9 GDPR, and we ask you not to enter them in the software.

4. Instructions

For the processing we do as processor, we process personal data solely on your documented instructions. The licence terms, this agreement and your use of the settings in the software together form those instructions. For that processing we do not process personal data for our own purposes, do not sell it and do not use it for advertising.

If the law requires us to process outside your instructions, we tell you beforehand, unless that same law prohibits it. If in our view an instruction infringes privacy law, we tell you without delay.

5. Confidentiality

Everyone we authorise to process personal data is bound to confidentiality, by contract or by law, and gets access only to the extent their work requires.

6. Security

We take appropriate technical and organisational measures under article 32 GDPR. On the effective date of this agreement they include:

• encryption of all traffic in transit (TLS);
• passwords stored only as strong one-way hashes (PBKDF2-SHA256, 210,000 iterations), and session tokens only as a hash, so that a copy of the database yields no working sessions;
• optional two-factor authentication for portal and console accounts, with the secrets stored encrypted, plus lockout after repeated failed logins and rate limiting per IP address;
• licence proofs signed with an ECDSA P-256 key, so that a licence decision cannot be forged;
• strict separation per company in every query, so that one customer’s data cannot be reached from another’s account;
• error reports scrubbed on the customer’s own machine before they are sent, not after they arrive;
• hardened web responses (content security policy, host allowlist, HSTS) and no external scripts, fonts, analytics or content delivery networks — our pages load nothing from third parties;
• daily backups, verified after they are written and kept for thirty days with restricted file permissions on the same European infrastructure;
• automatic deletion of logs and usage data at the end of their retention periods, as listed in our privacy statement;
• restricted access to production systems, limited to those who need it to operate the service.

We may change these measures as the state of the art moves on, provided the level of protection does not fall.

7. Sub-processors

You give us general authorisation to engage sub-processors. We impose on each of them, by contract, obligations equivalent to those in this agreement, and we remain fully liable to you for their actions. Our sub-processors are:

We tell you at least thirty days before we add or replace a sub-processor. If you have reasonable grounds to object, tell us within those thirty days; if we cannot resolve it, you may terminate the subscription with effect from the date the change takes effect, and we refund the unused part of the paid period.

8. Assistance

Taking into account the nature of the processing, we assist you with: requests from data subjects for access, rectification, erasure, restriction, objection or portability; your obligations to secure the processing; the notification of personal data breaches; and any data protection impact assessment or prior consultation.

If a data subject approaches us directly about processing we do as your processor, we do not answer on your behalf: we forward the request to you without undue delay. Through the customer portal — including its data export — you can already view, correct and delete most of this data yourself; where you cannot, we help within a reasonable time. Assistance is included in your subscription unless a request requires disproportionate effort; we then agree the costs with you in advance.

9. Personal data breaches

We notify you without undue delay, and in any event within forty-eight hours, after becoming aware of a personal data breach affecting your data. The notification describes what happened, which categories and approximately how many people and records are involved, the likely consequences, the measures we have taken and a point of contact. You, as controller, notify the supervisory authority and the data subjects; we give you what you need to do so.

10. Audit and information

On request we provide the information you reasonably need to demonstrate that we comply with article 28 GDPR. You may have an audit carried out once per calendar year, and in addition after a personal data breach affecting your data, by an independent expert bound to confidentiality, with at least thirty days’ notice, during office hours and without disrupting our operations or exposing other customers’ data. The costs are yours, unless the audit reveals a material shortcoming on our part; then they are ours.

11. Return and deletion

An administrator of your organisation can export the data at any time in the customer portal, and until thirty days after the end date (article 12 of the licence terms). Thirty days after the end date — and never sooner than fourteen days after we have notified you — we delete it; backups containing it expire within thirty days after that. We keep data longer only where the law requires it, and then only for that purpose and period: invoicing data, for example, which tax law requires us to keep for seven years. At your request we confirm the deletion in writing.

12. Where we are controller

For the purposes in article 1, second paragraph, we are controller and not your processor: the licence and seat checks, security and misuse prevention, error reports and usage statistics, anonymous arcade statistics, and our own customer administration. Our privacy statement describes that processing, its legal bases and the retention period of each category. Where that processing concerns your users, we ask you to point them to our privacy statement, for example in your own privacy notice to employees.

13. Transfers outside the EEA

We do not transfer personal data outside the European Economic Area. All processing under this agreement takes place on European infrastructure, with the sub-processors in article 7. Should that ever change, we notify you in advance under article 7 and ensure a valid transfer mechanism.

14. Liability, changes and law

The liability provisions of the licence and subscription terms also apply to this agreement, subject to mandatory law. Where those provisions and this agreement conflict on the processing of personal data, this agreement prevails.

We may change this agreement where legislation, guidance from supervisory authorities or the service require it. A new version is published here with its own version number and effective date and is announced at least thirty days in advance; earlier versions remain available (version 3.0). Dutch law applies, disputes go to the District Court of The Hague, and where the Dutch and English texts differ the Dutch text prevails.

15. Who we are

Privacy questions, a request from a data subject, or a signed copy of this agreement: info@dynsolutionz.com. See also the licence and subscription terms and the privacy statement.