All legal documents

Data Processing Agreement

Last updated: September 23, 2026

Data Processing Agreement

Version 2.0 — 23 September 2026

1. This agreement

This Data Processing Agreement ("DPA") applies to the processing of personal data by Full Join B.V. ("Full Join", "Processor", "we" or "us") on behalf of the customer ("Customer" or "Controller") in connection with the use of Databeamer.

The Customer and Full Join are each referred to individually as a "Party" and collectively as the "Parties".

1.1 Processor details

Full Join B.V.
Philitelaan 57, unit 404B
5617 AK Eindhoven, the Netherlands
Chamber of Commerce (KvK) number: 71160620
Telephone: 040 209 4163
General email: hello@databeamer.io
Privacy and compliance email: compliance@databeamer.io
Security incidents email: security@databeamer.io

Full Join provides Databeamer as a secure communication and collaboration platform.

1.2 Roles of the Parties

For personal data that the Customer processes via Databeamer and for which the Customer determines the purpose and means of the processing:

  • the Customer acts as controller within the meaning of Article 4(7) GDPR; and
  • Full Join acts as processor within the meaning of Article 4(8) GDPR.

This DPA sets out the arrangements between the Parties regarding that processing as referred to in Article 28 GDPR.

For certain processing activities, Full Join acts as an independent controller, for example for its own administration, invoicing, security, support, other own business processes, and the identity verification of users and organizations. These processing activities are not covered by this DPA, but by Full Join's Privacy Statement.

1.3 Relationship and order of precedence

This DPA forms an integral part of the agreement between the Customer and Full Join regarding Databeamer.

For matters relating to the processing of personal data on behalf of the Customer, this DPA takes precedence over all other contractual provisions, including any order, quotation, agreement or Service Level Agreement concluded between the Parties, and over the General Terms and Conditions. The same order of precedence is set out identically in the General Terms and Conditions.

This DPA does not limit the Parties' obligations under applicable privacy legislation.


2. Subject matter and duration of the processing

2.1 Subject matter

The subject matter of the processing is the provision and support of Databeamer, whereby the Customer may process personal data within the functionalities of the platform.

Databeamer includes, among other things:

  • Workspaces;
  • Drive;
  • Chat;
  • Mail;
  • Notes and Reports;
  • Transfers;
  • Requests;
  • Forms;
  • user and access management;
  • audit and security functions;
  • any additional functionalities that become part of the Service.

2.2 Duration

The processing continues for as long as the agreement between the Parties is in effect and Full Join processes personal data on behalf of the Customer.

Following termination of the agreement, the provisions regarding deletion, return, retention obligations and confidentiality set out in this DPA continue to apply.

2.3 Nature of the processing

Depending on the functionalities used by the Customer, the processing may consist of collecting, recording, storing, structuring, making available, transmitting, consulting, altering, erasing, securing and supporting the Service.

The actual processing is further determined by the choices and instructions of the Customer and by the functionalities the Customer uses.


3. Customer obligations

3.1 Lawful processing

The Customer is responsible for the lawful processing of personal data via Databeamer.

The Customer shall ensure, among other things:

  • a valid legal basis for the processing;
  • an appropriate purpose for the processing;
  • that data subjects are informed where required;
  • that the rights of data subjects are respected;
  • the accuracy of the personal data;
  • appropriate retention periods;
  • the lawful provision of personal data to Full Join.

3.2 Instructions

The Customer shall give Full Join only lawful and documented instructions for the processing of personal data.

The agreement, this DPA and the Databeamer functionalities used by the Customer together form the basis for the processing. Additional instructions may be provided in writing.

Full Join may refuse or suspend an instruction where, in its reasonable judgment, it is contrary to applicable privacy legislation or cannot be technically implemented within Databeamer's architecture.

3.3 Responsibility for content

The Customer remains responsible for the personal data it processes via Databeamer and for the content it stores, exchanges or makes available within Databeamer.

This applies in particular to:

  • the lawfulness of the processing;
  • the categories of personal data processed;
  • the individuals whose data is processed;
  • access rights;
  • retention periods;
  • any special categories of personal data.

4. Full Join's obligations

4.1 Processing in accordance with instructions

Full Join processes personal data on behalf of the Customer only to the extent necessary to provide and support Databeamer, and in accordance with:

  • this DPA;
  • the agreement;
  • documented instructions from the Customer;
  • applicable privacy legislation.

Where Full Join is legally required to process personal data otherwise, Full Join will, to the extent legally permitted, inform the Customer in advance.

4.2 No use of customer content for Full Join's own purposes

Full Join does not use personal data that it processes as processor on behalf of the Customer for its own commercial purposes.

Full Join does not use the plaintext of protected, client-side encrypted customer content for:

  • advertising purposes;
  • commercial profiling;
  • training artificial intelligence models;
  • other purposes of its own that are not necessary for the provision of the Service.

Protected customer content is not available to Full Join in plaintext. Full Join does not hold sufficient key material to independently decrypt such content.

4.3 Technical limitation on access to protected customer content

Databeamer uses client-side end-to-end encryption. The normative description of that architecture, including what is and is not visible to the server and the modes available for delivery to recipients without a Databeamer account, is set out in Chapter 4 of the Security Policy.

For the purposes of this DPA, the following consequences are relevant. Full Join cannot independently:

  • read protected customer content;
  • search its content;
  • analyze its content;
  • alter its content;
  • decrypt it on behalf of the Customer.

This technical limitation does not affect the fact that Full Join processes certain operational, technical and security data necessary for the operation and security of Databeamer.

For the delivery mode with email verification, described in §4.5 of the Security Policy, the limitation described above does not apply to the same extent: for those transmissions, a technical path exists through which the key can be unlocked, solely following verification of the recipient and solely on a per-access basis. The Customer determines, per transmission, which mode is used.


5. Confidentiality

5.1 Confidentiality

Full Join treats personal data it processes on behalf of the Customer as confidential. Full Join ensures that persons who have access to personal data on its behalf:

  • process it only to the extent necessary for their duties;
  • are bound by appropriate confidentiality obligations;
  • receive appropriate security instructions.

5.2 Need-to-know

Access to personal data within Full Join's systems is restricted according to the principle of least privilege and need-to-know. Where possible, access is technically restricted to the systems and data necessary for the relevant task.


6. Security of personal data

6.1 Appropriate measures

Full Join implements appropriate technical and organizational measures in accordance with Article 32 GDPR, taking into account:

  • the state of the art;
  • the costs of implementation;
  • the nature, scope, context and purposes of the processing;
  • the likelihood and severity of risks to data subjects.

Full Join maintains an information security management system (ISMS) established in accordance with ISO/IEC 27001:2022 and the Annex A controls.

6.2 Overview of the measures

The technical and organizational measures implemented by Full Join are set out in Annex B to this DPA.

The Security Policy describes these measures in greater detail and in context; the Technology page describes the cryptographic details.


7. Assistance to the Customer

Full Join assists the Customer, taking into account the nature of the processing and the information available, in complying with its obligations under the GDPR.

This includes, among other things:

  • requests from data subjects;
  • security incidents and personal data breaches;
  • data protection impact assessments (DPIAs);
  • prior consultation with a supervisory authority;
  • questions from supervisory authorities;
  • information necessary to demonstrate compliance with Article 32 GDPR.

The extent of the assistance is determined by what is reasonably possible from a technical and organizational perspective.


8. Rights of data subjects

8.1 Requests from data subjects

Where Full Join receives a request from a data subject relating to personal data that it processes on behalf of the Customer, Full Join will notify the Customer without undue delay, unless Full Join is legally required to respond to the request itself.

The Customer remains responsible for handling requests from data subjects.

8.2 Technical limitation

Due to the client-side encryption architecture, Full Join does not have access to the plaintext of protected customer content (see §4.3).

Full Join is therefore unable to independently:

  • provide access to the plaintext of protected customer content;
  • correct protected content;
  • substantively erase protected content;
  • substantively transfer protected content.

To the extent Databeamer's functionality enables the Customer to perform such actions, the Customer may do so itself. Within the technical possibilities of the Service, Full Join provides reasonable support for requests from data subjects.


9. Personal data breaches and security incidents

9.1 Classification and response

Full Join maintains a documented incident management process. Each incident is classified upon report; the classification determines the response time and escalation path:

Priority Example Initial response
P1 — Critical Active attack, suspected breach of customer data, outage of all production clusters, suspected compromise of cryptographic keys within 1 hour
P2 — High Successful unauthorized access with no indications of data exfiltration, loss or theft of a device within 4 hours
P3 — Normal Identified vulnerability in production that has not yet been exploited within 8 hours on a business day
P4 — Low Potential policy deviation with no direct impact, routine report via the vulnerability reporting procedure next business day

9.2 Notification to the Customer

Where Full Join becomes aware of a personal data breach relating to personal data it processes on behalf of the Customer, Full Join will inform the Customer without delay and no later than within 24 hours of discovery.

This period is deliberately shorter than the statutory period applicable to the Customer itself. This gives the Customer sufficient time to meet its own obligation to notify the Dutch Data Protection Authority within 72 hours (Article 33 GDPR), and to comply with any notification obligations under the NIS2 Directive or the Cyber Security Act (Cyberbeveiligingswet) that apply to the Customer.

The notification is sent to the security contact designated by the Customer, by email and, where necessary, by telephone. The Customer is responsible for keeping that contact up to date.

9.3 Content of the notification

The notification includes, to the extent known and reasonably available:

  • the nature of the incident;
  • the systems or processing activities involved;
  • the categories of personal data;
  • the categories and, where possible, the number of data subjects concerned;
  • the possible consequences;
  • measures taken or proposed;
  • a point of contact for further information.

Full Join does not wait for full technical certainty before notifying. The notification is supplemented as new information becomes available.

9.4 Full Join's own notification obligation

Where an incident relates to personal data for which Full Join itself acts as controller, Full Join will report it to the Dutch Data Protection Authority within 72 hours of discovery, in accordance with Article 33 GDPR, and will inform data subjects where legally required.

9.5 Cooperation and evaluation

Full Join takes appropriate measures to contain an incident and limit its consequences.

Full Join reasonably cooperates with the assessment of the incident and with the Customer's obligations toward supervisory authorities and data subjects. The Customer remains responsible for its own statutory notification and information obligations.

Following the closure of an incident classified as P1 or P2, Full Join carries out an evaluation documenting the cause, detection, remediation and preventive measures. The outcomes relevant to the Customer are shared upon request.


10. Sub-processors

10.1 General authorization

The Customer grants Full Join general authorization to engage sub-processors to the extent necessary to provide and support Databeamer.

Full Join ensures that every sub-processor is contractually obligated to provide appropriate protection of personal data.

10.2 Sub-processor obligations

Full Join imposes obligations on sub-processors that provide a level of protection at least equivalent to the relevant obligations set out in this DPA. These obligations include, among other things:

  • processing solely for agreed purposes;
  • confidentiality;
  • appropriate technical and organizational security measures;
  • support with personal data breaches and data subject requests;
  • deletion or return of personal data where applicable.

10.3 Current list of sub-processors

Full Join currently engages the following sub-processors for the processing of personal data on behalf of the Customer:

Sub-processor Location Service Processing location
Scaleway SAS France Compute, Kubernetes, PostgreSQL, Redis and object storage for Databeamer's production environment European Union, Amsterdam region
Scaleway SAS (Transactional Email) France Sending of transactional email, such as invitations, notifications and verification codes European Union
Scaleway SAS (Key Manager) France Key management for the delivery mode with email verification, described in §4.5 of the Security Policy European Union, Amsterdam region

Databeamer's identity and access infrastructure runs on software that Full Join manages and hosts itself on the infrastructure referred to above. No separate external identity provider is involved.

For Databeamer's public website, Full Join uses web analytics without tracking cookies. This processing falls outside this DPA and is described in the Privacy Statement and the Cookie Policy.

10.4 New sub-processors and objection

Full Join may add new sub-processors or replace existing sub-processors.

Where such a change may affect the processing of personal data on behalf of the Customer, Full Join will inform the Customer prior to it taking effect, to the extent reasonably possible.

The Customer may raise a reasoned objection, on grounds reasonably relating to data protection, within thirty calendar days of notification.

In that event, the Parties will work in good faith to find an appropriate solution. Where the Parties fail to reach a solution within thirty calendar days of the objection, the Customer may terminate the agreement, or the part thereof relating to the relevant sub-processor, free of charge and with immediate effect. In that case, Full Join will refund prepaid amounts on a pro-rata basis.


11. European processing and international transfers

11.1 European hosting

Databeamer's production environment and the customer data stored therein are hosted within the European Union. The primary hosting environment is located in the Amsterdam region.

For hosting, Full Join uses Scaleway, a fully European cloud provider.

Full Join designs its infrastructure so that customer data is processed and stored within the European Union and so that the primary service is not dependent on a US cloud provider or comparable infrastructure outside the European Union.

11.2 Protected customer content

The client-side encryption architecture limits the ability of Full Join and its infrastructure providers to access the plaintext of protected customer content, as described in Chapter 4 of the Security Policy.

11.3 Supporting services

For certain supporting services, Full Join may use providers that do not have the same role as the primary hosting infrastructure. Full Join assesses whether such a provider processes personal data.

Where personal data is processed or made accessible outside the European Economic Area, Full Join ensures an appropriate legal basis and the required safeguards in accordance with Chapter V GDPR.

11.4 Transfers by the Customer

The Customer remains responsible for the lawfulness of any transfer of personal data that it itself carries out from Databeamer to recipients outside the European Economic Area.

Full Join does not become responsible, through the use of Databeamer, for an independent transfer initiated by the Customer or by a recipient designated by the Customer.


12. Requests from supervisory authorities and government bodies

Where Full Join receives a legally binding request from a competent government authority relating to personal data it processes on behalf of the Customer, Full Join will act in accordance with applicable legislation.

To the extent legally permitted, Full Join will assess the validity and scope of such a request and inform the Customer in advance. Where prior notification is not legally permitted, Full Join will inform the Customer as soon as it is legally able to do so.

Where a request concerns access to protected, client-side encrypted customer content, Full Join does not hold sufficient key material to independently decrypt such content.


13. Retention, deletion and return

13.1 Principle

Full Join does not retain personal data on behalf of the Customer for longer than necessary for the provision of the Service or in accordance with the Customer's instructions, unless statutory obligations require a longer retention period.

13.2 Retention periods configurable by the Customer

The retention period for data within Databeamer differs per functionality and is largely determined by the Customer's settings and instructions. The Customer may, among other things, configure:

  • a retention period per Request or Form, after which submitted data and associated files are automatically cleared;
  • an expiry date per Transfer, after which the transmission and associated files expire;
  • a retention period upon deletion of a workspace, linked to the classification of that workspace; until the end of that period, the workspace is hidden and read-only and can be restored, after which the content is permanently deleted;
  • the deletion or expiry of individual content within Drive, Chat, Mail, Notes and Reports, Transfers, Requests and Forms, depending on the rights of the relevant user.

Where the Customer does not configure a retention period, content persists for as long as the relevant workspace and the agreement exist.

13.3 Deletion of a user account

Where a user deletes their account, or an administrator does so on their behalf, the account is scheduled for deletion. After a grace period of 30 days, the user's data is permanently deleted: data managed by them is erased, the corresponding storage in the block storage system is cleared, and the user's own data is anonymized. Deletion may be cancelled within the grace period.

Audit data relating to actions already carried out is retained, in anonymized form where possible. See §13.6.

13.4 Termination of the agreement

Following termination of the agreement, Full Join will, at the Customer's choice and to the extent technically possible, return or delete the personal data. This does not apply to the extent Full Join is legally required to retain data.

Following termination, the Customer retains access to Databeamer's export functionality for thirty days, as set out in the General Terms and Conditions.

13.5 Technical limitation for encrypted content

Protected, client-side encrypted customer content is not available to Full Join in plaintext. Full Join is therefore unable to return such content in plaintext upon request, or to delete it in a manner that can only be carried out through access to the plaintext.

The technical possibilities for deleting and managing such content are determined by Databeamer's functionality and the instructions available to the Customer.

13.6 Audit and security data

Audit and security data is retained for as long as necessary for security, management, incident investigation, accountability, and statutory or contractual obligations.

This data persists after the underlying content has been deleted or after an account has been deleted. An audit trail that disappears along with the content has no evidentiary value, and both the Customer and Full Join need that trail to be able to establish afterward what occurred.

The Customer may access and export the audit data relating to its own organization and workspaces within Databeamer.


14. Audit and accountability

14.1 Information

Full Join makes available, upon reasonable request, information necessary to demonstrate compliance with the obligations under this DPA. This may include, among other things:

  • relevant policy documents;
  • descriptions of technical and organizational measures;
  • security documentation;
  • certifications;
  • audit or assurance information that is reasonably available;
  • information about relevant sub-processors.

14.2 Audits

Where reasonably necessary to assess compliance with Article 28 GDPR, the Customer may request an audit or assessment.

The Parties will, as far as possible, make use of existing certifications, reports, documentation and other assurance information before an additional audit is carried out.

An additional audit:

  • is agreed in writing in advance;
  • is carried out with reasonable regard for business continuity and information security;
  • may not provide access to data belonging to other customers;
  • may not unnecessarily expose security measures or confidential information;
  • is carried out by the Customer or by an independent expert bound by appropriate confidentiality obligations.

The costs of an additional audit are, in principle, borne by the Customer. Where the audit reveals a material shortcoming in Full Join's compliance with this DPA, the reasonable costs of that audit are borne by Full Join, and Full Join will remedy the identified shortcoming within a reasonable period.


15. Processing overview

The nature of the processing may differ per Databeamer functionality.

Element Description
Subject matter of processing Providing and supporting Databeamer as a secure communication and collaboration platform
Duration For the term of the agreement and for as long as processing takes place on behalf of the Customer
Purposes Storage, communication, collaboration, exchange, access management, security, audit and other functionalities instructed by the Customer
Processing activities Collecting, recording, storing, making available, transmitting, consulting, altering, erasing and securing, to the extent technically possible
Systems The Databeamer application, infrastructure, APIs and supporting systems necessary for the Service

15.1 Categories of data subjects

Depending on the use of Databeamer, personal data may relate to:

  • employees of the Customer;
  • employees of collaboration partners;
  • customers and clients of the Customer;
  • suppliers;
  • contractors;
  • patients, clients or other individuals who are the subject of a file or of communication;
  • contact persons;
  • external collaboration partners;
  • recipients without a Databeamer account to whom the Customer sends information or from whom it requests information;
  • other individuals whose personal data the Customer processes.

15.2 Categories of personal data

Depending on the use of the Service, the following categories of personal data may, among others, be processed:

  • name and identification data;
  • contact details;
  • account and user data;
  • organization and job-related data;
  • access and authorization data;
  • communication data;
  • data contained in documents and files;
  • data contained in Notes and Reports;
  • data contained in Mail and Chat;
  • data contained in Requests, Forms and Transfers;
  • technical data;
  • audit and security data;
  • other personal data processed by the Customer within Databeamer.

15.3 Special categories

Depending on the Customer's services, special categories of personal data as referred to in Article 9 GDPR may also be processed.

The Customer is responsible for determining whether, and under what conditions, such data may be processed.

15.4 Personal data relating to criminal matters

Where the Customer processes personal data relating to criminal convictions and offenses via Databeamer, the Customer remains responsible for ensuring the existence of the required legal basis and appropriate safeguards.


16. Changes to this DPA

Full Join may amend this DPA where:

  • laws and regulations change;
  • the services or the technical architecture change materially;
  • security measures are adjusted;
  • new sub-processors are engaged;
  • changes are necessary to comply with statutory obligations.

Material changes are communicated to the Customer at least thirty days before they take effect. Changes may not materially reduce the level of protection of personal data.

Where the Customer does not accept a material change, it may terminate the agreement free of charge within thirty days of the notice, effective as of the date the change takes effect. In that case, Full Join will refund prepaid amounts on a pro-rata basis. This right of termination does not apply to changes that are purely editorial in nature or that increase the level of protection.


17. Term and termination

This DPA takes effect as soon as the underlying agreement for the use of Databeamer becomes effective, and remains in effect for as long as Full Join processes personal data on behalf of the Customer.

Upon termination of the underlying agreement, provisions that by their nature are intended to survive remain in effect, including:

  • confidentiality;
  • security obligations;
  • deletion and return;
  • statutory retention obligations;
  • liability for obligations already incurred.

18. Governing law and competent court

This DPA is governed by Dutch law.

Disputes arising from or in connection with this DPA will be submitted to the competent court in the Netherlands, in accordance with the provisions of the underlying agreement between the Parties.

Where mandatory law prescribes a different competent court or different governing law, those provisions continue to apply.


Appendix A — Definitions

GDPR
The General Data Protection Regulation (Regulation (EU) 2016/679).

Data subject
An identified or identifiable natural person to whom personal data relates.

Special categories of personal data
The categories of personal data referred to in Article 9 GDPR.

Service
The Databeamer service offered by Full Join, including, depending on the agreement and the subscription chosen, the website, the application, Workspaces, Drive, Chat, Mail, Notes and Reports, Transfers, Requests, Forms, APIs and related functionalities.

Customer
The natural person or legal entity that has entered into an agreement with Full Join for the use of Databeamer.

Customer content
Data, files, messages, notes, forms, requests, communications and other content stored, sent or processed by or on behalf of the Customer or its users within Databeamer.

Protected customer content
Customer content that is protected by Databeamer's client-side encryption architecture and for which Full Join does not hold sufficient key material to independently decrypt it in plaintext.

Personal data
Any information relating to an identified or identifiable natural person as referred to in Article 4(1) GDPR.

Processing
Any operation or set of operations performed on personal data, such as collection, recording, organization, structuring, storage, updating, consultation, use, disclosure, transmission, erasure or destruction.

Processor
Full Join B.V., to the extent it processes personal data on behalf of the Customer.

Controller
The natural person or legal entity that determines the purposes and means of the processing of personal data.

Sub-processor
A third party engaged by Full Join to process personal data on behalf of the Customer in connection with the Service.

Personal data breach
A breach relating to personal data as referred to in Article 4(12) GDPR.

European Economic Area (EEA)
The European Union, Iceland, Liechtenstein and Norway.


Appendix B — Technical and organizational security measures

Full Join has implemented appropriate technical and organizational measures to protect personal data. The Security Policy describes these measures in context; this appendix provides the overview relevant to this DPA.

B.1 Information security management

  • a formal information security management system (ISMS), established in accordance with ISO/IEC 27001:2022 and the Annex A controls;
  • risk assessment and risk treatment;
  • security policy and procedures;
  • periodic evaluation of security measures.

B.2 Encryption and data protection

  • client-side end-to-end encryption of protected customer content;
  • cryptographic protection of data in transit and at rest;
  • key management in accordance with Databeamer's technical architecture;
  • separation of key material;
  • integrity protection of protected data.

The exact cryptographic implementation is set out in Databeamer's current technical documentation and may be adjusted where security insights or the state of the art so require. More information is available on the Technology page.

B.3 Identity and access management

  • least privilege;
  • need-to-know;
  • role-based access control;
  • mandatory multi-factor authentication for all user accounts, except where the user logs in via SSO; see §6.5 of the Security Policy;
  • an additional factor before encrypted content becomes accessible on a device;
  • timely revocation of access rights;
  • monitoring of relevant authentication events.

B.4 Logging and monitoring

  • logging of relevant system and security events;
  • cryptographically signed audit logging of relevant user actions;
  • protection of log data against unauthorized alteration;
  • monitoring of suspicious activity;
  • security alerts;
  • incident registration and follow-up.

B.5 Application security

  • secure software development;
  • code review;
  • vulnerability management;
  • security testing;
  • dependency management;
  • input validation;
  • measures against common application vulnerabilities.

B.6 Infrastructure and network security

  • separation of production, development and test environments;
  • network security and network segmentation;
  • firewall and access controls;
  • restriction of administrative access;
  • rate limiting and anti-abuse measures;
  • measures against DDoS and other availability attacks.

B.7 Backup and recovery

  • backup and recovery procedures;
  • protection of backups against unauthorized access;
  • storage of backups within the European Union;
  • redundant deployment across multiple zones within the Amsterdam region;
  • annual testing of recovery procedures.

B.8 Incident management

  • a documented incident management process with priority classification and response times;
  • procedures for security incidents and personal data breaches;
  • incident escalation;
  • analysis and follow-up;
  • corrective and preventive measures;
  • annual testing of the incident response process.

B.9 Personnel and confidentiality

  • confidentiality obligations;
  • appropriate security instructions;
  • security awareness;
  • access management based on role and necessity;
  • procedures for onboarding, role changes and offboarding.

B.10 Suppliers and sub-processors

  • assessment of relevant suppliers;
  • contractual security and privacy obligations;
  • management of sub-processors;
  • assessment of changes in the supply chain.

Appendix C — Processing instructions

The Customer instructs Full Join to process personal data for the provision and support of Databeamer in accordance with the agreement, this DPA and the functionalities used by the Customer.

The instructions include, depending on use:

  1. making Workspaces available;
  2. storing and making available data within Drive;
  3. facilitating communication via Chat and Mail;
  4. facilitating Notes and Reports;
  5. facilitating Transfers;
  6. facilitating Requests and Forms;
  7. managing users and access rights;
  8. recording audit and security data on relevant system and user actions, cryptographically signing such data where the functionality provides for this, protecting that data against alteration, retaining it in accordance with §13.6, and making it available to the Customer for review and export;
  9. carrying out necessary technical and administrative actions to keep the Service available and secure.

The Customer may give additional documented instructions to the extent these are compatible with the Service, this DPA and applicable legislation.


Contact

For questions regarding this Data Processing Agreement:

Full Join B.V.
Philitelaan 57, unit 404B
5617 AK Eindhoven, the Netherlands
Chamber of Commerce (KvK) number: 71160620
Telephone: 040 209 4163
Email: compliance@databeamer.io