Data processing agreement

Last updated: October 7, 2026

This proposed agreement is for projects in which Devife processes personal data on a client's instructions. Devife is established at Hermesweg 4A, 3741 GP Baarn, the Netherlands; its privacy contact is info@devife.com. It applies only after written acceptance by both parties and completion of the processing schedule. It is not a statement that every Devife service involves processor activity.

Roles, scope and instructions

The client is the controller, or a processor authorised by its controller to appoint Devife as a subprocessor. Devife acts as processor or subprocessor only for the processing identified in the schedule. The GDPR and applicable data protection law govern that processing. For Devife's own enquiries and administration, see the privacy policy.

Devife processes data only on documented lawful instructions, including instructions about transfers, unless legally required otherwise. It informs the client of a legal requirement before processing unless the law prohibits notice. Devife promptly informs the client if an instruction appears to infringe data protection law. The client determines the purpose, legal basis, notices and rights arrangements and supplies lawful instructions. Devife does not sell client personal data or use it for independent advertising or model training.

Confidentiality and security

Devife ensures authorised personnel are bound by confidentiality and access only what their tasks require. Before processing, parties document appropriate technical and organisational measures under Article 32 GDPR in the security schedule. These include access control and least privilege; suitable authentication; encryption where appropriate; secure configuration and patching; logging and incident response; backup and recovery where within scope; and periodic assessment of measures. The schedule states actual implementation, responsibilities and any justified alternatives; this page does not claim certifications or measures not documented for the project.

Subprocessors

The accepted subprocessor schedule identifies each provider, service, processing location and transfer safeguard. The client's general written authorisation applies only to that agreed list. Devife gives at least 30 days' written notice before adding or replacing a subprocessor and allows a reasoned data protection objection before use. Parties seek a reasonable alternative; if none is available, the client may end the affected service before the change. Devife imposes equivalent relevant data protection obligations by written contract and remains responsible for its subprocessors' performance.

Assistance and incidents

Taking account of the nature of processing and available information, Devife assists the client with data subject requests and compliance with Articles 32–36 GDPR, including security, breach notifications, impact assessments and supervisory consultation. Requests received directly are forwarded promptly; Devife does not independently answer them except on instructions or where law requires.

Devife notifies the client without undue delay after becoming aware of a personal data breach. The notice includes, as information becomes available, its nature, affected data and individuals, likely consequences, mitigation and a contact point. Devife investigates, mitigates and cooperates, providing updates as needed. The client's regulatory notification duties and deadlines remain its responsibility; Devife's notification is not delayed until a complete investigation.

Transfers, evidence and audits

Processing locations and any transfers outside the EEA require documented instructions and a valid GDPR Chapter V mechanism. Where standard contractual clauses are required, parties execute the appropriate unmodified modules and complete their annexes and any supplementary measures before transfer. This page alone neither executes those clauses nor supplies their annexes. UK or Swiss requirements are addressed separately if relevant.

Devife provides information needed to demonstrate Article 28 compliance and permits and contributes to audits, including inspections, by the client or its mandated auditor. Parties coordinate reasonable notice, confidentiality and protection of unrelated client data; these arrangements must not prevent a required audit or supervisory access. Any charges for additional assistance must be reasonable and agreed, and cannot remove mandatory obligations.

End of processing and precedence

At the client's choice, Devife returns or deletes personal data and deletes copies after services end, unless law requires retention. The schedule specifies export format, deadlines and the backup deletion cycle. Retained data remains protected and is processed only for the retention requirement or protected recovery until deletion. On request, Devife confirms completion.

This agreement prevails over service terms for personal data obligations; mandatory law and any applicable standard contractual clauses take precedence. Contractual liability terms cannot restrict data subjects' or authorities' statutory rights. Dutch law applies without changing mandatory jurisdiction or data protection rights.

Required project schedules and acceptance

Before processing, parties sign a schedule recording:

1. Their full legal names, addresses, roles, contacts, authorised signatures, effective date and this version date.
2. Subject matter, duration, nature and purpose of processing, operations, frequency, categories of people and personal data, and any sensitive data and extra safeguards.
3. Documented instructions, approved locations and international transfer mechanisms with completed annexes where applicable.
4. Actual security measures and the responsibility of each party.
5. Approved subprocessors, locations, tasks and safeguards.
6. Return/deletion arrangements, export format, deadlines and backup retention.

Request the schedules via info@devife.com. Processing does not begin until these details and safeguards are agreed.