Data processing agreement

1. Parties and conclusion

This data processing agreement applies between the company that creates a KompaniX account (the controller, “you”) and WEBSHOT, a sole proprietorship registered with the Dutch Chamber of Commerce under number 51317915 (the processor, “we”). The company details are in the imprint.

The agreement is concluded when you accept the terms of use while creating the account, and applies for as long as the account exists, including during the free trial. A signed copy is not required; if you would like one, ask for it through the email address in the imprint.

2. Subject and duration

We process personal data only to provide KompaniX: storing, displaying, sending and processing the data you and your team put into KompaniX or that comes in through KompaniX, such as forms, email to your company’s address and replies in the client portal. The processing lasts as long as the agreement, plus the periods in section 10.

3. Types of data and data subjects

Data subjects: your clients and their contacts, visitors who use a form or the client portal, senders of email to your company’s address, and the members of your team.

Data: name, company name, address, email address, phone number, Chamber of Commerce and VAT numbers, quote, invoice and payment details (without card data), the content of tickets, messages and attachments, the electronic acceptance of a quote (name, time, IP address), and logs of sign-ins and actions.

KompaniX is not intended for special categories of personal data, such as health data. Only put such data in if your service requires it and you have assessed the risks yourself.

4. Instructions

We process the data only on your documented instructions; this agreement and what you and your team configure and do in KompaniX count as those instructions. We do not use the data for our own purposes, do not sell it and do not let AI models be trained on it.

If we believe an instruction infringes the GDPR, we tell you immediately. If the law requires us to disclose data, we tell you beforehand, unless the law prohibits it.

5. Confidentiality

Only the owner of WEBSHOT has access to the data, and only as far as needed for administration, for support at your request or to resolve an outage. Anyone who later gets access on our behalf is bound to confidentiality in writing.

6. Security

We take appropriate technical and organisational measures, including: a separate database per company, stored in the European Union; encrypted connections (HTTPS) for all traffic; passwords stored only as salted hashes; two-step verification and passkeys for your team; roles per team member; a log of actions in the administration; integration keys stored encrypted; storage recovery points going back up to thirty days; and prompt updates of the software KompaniX runs on.

More about this is on the Security and data page.

7. Sub-processors

You authorise the use of the sub-processors listed below. We have a data processing agreement with each of them containing at least the same obligations. Transfers outside the European Economic Area are covered by the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework.

We announce a new sub-processor at least thirty days in advance, on this page and by email to the account owner. You can object within that period; if we cannot find a solution together, you can cancel the subscription free of charge.

If you connect your own Mollie account for your clients’ payments, or another service you switch on yourself, you enter into your own agreement with that party; it is then not our sub-processor.

Cloudflare, Inc.

Hosting, databases, file storage and receiving email. Storage in the European Union; company based in the United States.

Resend (Plus Five Five, Inc.)

Sending email on behalf of your company. United States.

Anthropic, PBC

The AI assistant: only the text needed for a task you or your team start or switch on; not used for training. United States.

8. Data subject rights

You handle most requests yourself: view, correct and delete a client’s data in the administration, and export all of your company’s data as a ZIP archive (JSON, CSV and files) from Settings. If a request reaches us, we forward it to you. If you cannot handle it yourself, we help, at no extra cost within reasonable use.

9. Personal data breaches

If we discover a security breach affecting your data, we notify the account owner without undue delay and at the latest within 48 hours of discovery, with what we know at that moment: what happened, which data and data subjects are affected, the likely consequences and the measures taken. This lets you notify the supervisory authority within 72 hours where required.

We also assist with a data protection impact assessment (DPIA) or a prior consultation if you need one.

10. End and deletion

When the trial or the subscription ends, we keep the environment for another thirty days; during that time you can export all data. After that we permanently delete your company’s database and files; the recovery points expire no later than thirty days afterwards. Records we are legally required to keep ourselves, such as our invoices to you, are not affected.

11. Information and audits

We provide you with all information needed to demonstrate that we comply with this agreement. An audit by an independent expert is possible once a year, with thirty days’ notice, at your expense and without access to other companies’ data.

12. Liability and precedence

Liability is governed by the terms of use. In the event of a conflict between this agreement and the terms of use, this agreement prevails as far as the processing of personal data is concerned. This agreement is governed by Dutch law.

13. Changes

We may amend this agreement, for example when adding a sub-processor or after a change in the law. A change that limits your rights is announced by email at least thirty days in advance. The date at the top shows the version in force.