Data processing agreement (GDPR): Agreements on your customers’ data.

Parties and roles

This agreement applies between the client (controller) and Vorlyo, a trading name of JKF Commerce, based in Amsterdam, Chamber of Commerce 92785379 (processor). It forms part of the agreement for the software, website or hosting and applies for as long as that agreement runs.

Subject, nature and purpose

Vorlyo processes personal data solely to provide, secure, maintain and support the software, website and hosting. This includes storing, displaying, sending confirmations and reminders, making backups and resolving incidents.

It concerns data that the client and its customers enter in the software, such as names, contact details, appointments, orders, quotes, invoices and messages. Data subjects are the client’s customers, guests, students, staff and contacts. Special categories of personal data do not belong in the software unless agreed in writing.

Only on instructions

Vorlyo processes the data only on the client’s documented instructions, as set out in the agreement and the settings of the software, and never for its own purposes. If Vorlyo considers an instruction unlawful, it notifies the client immediately.

Everyone at Vorlyo with access to the data is bound by confidentiality and only receives access to the extent their work requires.

Security

Vorlyo takes appropriate technical and organisational measures (Art. 32 GDPR): encrypted connections, role-based access enforced on the server, data separated per client, storage in European data centres, daily backups, limited sign-in attempts and sessions that can be revoked remotely, and continuous availability monitoring.

Sub-processors

The client consents to the use of the sub-processors listed below. Vorlyo imposes the same obligations on them as in this agreement and remains responsible for their compliance. Vorlyo announces a new sub-processor by email at least thirty days in advance; the client may object with reasons.

Where a sub-processor processes data outside the European Economic Area, this is based on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses.

Cloudflare

European Union

Amazon Web Services

European Union

Mollie, Stripe

European Union

Anthropic

United States, under the EU-US Data Privacy Framework

Apple

United States, under the EU-US Data Privacy Framework

Data subject rights and assistance

The client can view, correct, export and delete data in the software itself. Where that is not enough, Vorlyo assists within a reasonable period with data subject requests, a data protection impact assessment or questions from the supervisory authority.

Personal data breaches

Vorlyo notifies the client of a personal data breach without undue delay and no later than 24 hours after discovery, with what is known at that time: the nature of the breach, the data concerned, the likely consequences and the measures taken. The client decides on notifying the Dutch Data Protection Authority and data subjects.

End of the agreement

After the end, the client can export its data within thirty days. Vorlyo then deletes the data, including from backups as soon as they expire under the fixed retention period, unless the law requires retention.

Audits and liability

On request, Vorlyo provides the client with the information needed to demonstrate compliance with this agreement and cooperates with a reasonable audit, at the client’s expense and with reasonable notice. Liability is governed by the main agreement.

This agreement is governed by Dutch law. Request a signed version in your company’s name at info@vorlyo.com.