Our Article 28 GDPR agreement for the personal data you process in PPS ERP.
Some company details in this document are still being completed and are marked as such.
1.1 This Data Processing Agreement ("DPA") is concluded between the customer that uses PPS ERP (the "Controller") and PPS — Practical Programming Systems, [to be completed: street address], registered with the Kamer van Koophandel (KvK) under number [to be completed: Chamber of Commerce (KvK) number] (the "Processor").
1.2 The DPA forms part of the agreement for the provision of PPS ERP (the "Main Agreement", including our Terms of Service). It is accepted electronically together with the Main Agreement, which satisfies the written form required by Article 28(9) GDPR.
1.3 The DPA applies to all personal data that the Processor processes on behalf of the Controller in providing the Service ("Personal Data"). The details of the processing are set out in Annex 1.
Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given in Regulation (EU) 2016/679 (the "GDPR").
3.1 The Processor processes Personal Data only on documented instructions from the Controller, including with regard to international transfers, unless required to do otherwise by EU or member state law; in that case the Processor informs the Controller before processing unless that law prohibits it.
3.2 The Main Agreement, this DPA and the Controller's use and configuration of the Service — including the Integrations it connects and the rules it sets up — constitute the Controller's documented instructions.
3.3 The Processor informs the Controller immediately if, in its opinion, an instruction infringes data protection law.
3.4 The Processor does not process Personal Data for its own purposes, does not sell it, and does not combine it with data of other customers. Aggregated, anonymous information about the use of the Service may be used to operate and improve the Service.
The Processor ensures that persons authorised to process Personal Data are bound by confidentiality and only have access to the extent necessary for their tasks.
5.1 The Processor implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk (Article 32 GDPR).
5.2 The Processor may update these measures as technology and risks develop, provided the overall level of security is not reduced.
5.3 The Controller is responsible for the security of its own devices and credentials, for granting Authorised Users appropriate roles, and for the settings it controls in the Service, such as support access.
6.1 The Controller gives general written authorisation for the Processor to engage the sub-processors listed in Annex 3.
6.2 The Processor informs the Controller at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable data-protection grounds within that period. The parties will then discuss an alternative in good faith; if none is found, the Controller may terminate the affected part of the Main Agreement before the change takes effect, with a pro-rata refund of prepaid fees.
6.3 The Processor imposes data-protection obligations on each sub-processor that are equivalent to those in this DPA and remains responsible towards the Controller for its sub-processors' performance.
6.4 Third-party platforms that the Controller connects to the Service (for example bol.com, Amazon, Shopify or a payment or email provider of the Controller) are not sub-processors of the Processor. The Controller exchanges data with them under its own agreements.
7.1 The Service is hosted in the European Union (EU/EEA).
7.2 Where a sub-processor processes Personal Data outside the EU/EEA, or it can be accessed from there, the Processor ensures a valid transfer mechanism under Chapter V GDPR — an adequacy decision, including the EU–U.S. Data Privacy Framework for certified recipients, or the European Commission's Standard Contractual Clauses with supplementary measures where necessary.
8.1 Taking into account the nature of the processing, the Processor assists the Controller with appropriate technical and organisational measures in responding to requests from data subjects. The Service provides functions to access, export, correct and anonymise personal data of the Controller's customers, suppliers' contacts and employees.
8.2 If the Processor receives a request directly from a data subject relating to Personal Data, it forwards the request to the Controller without undue delay and does not respond itself, except to refer the data subject to the Controller.
9.1 The Processor notifies the Controller without undue delay, and in any case within 48 hours after becoming aware, of a personal data breach affecting Personal Data.
9.2 The notification describes, to the extent known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Information that is not yet available is provided as it becomes available.
9.3 The Processor takes reasonable measures to contain the breach and mitigate its effects, and supports the Controller in meeting its notification obligations towards the supervisory authority and data subjects.
The Processor provides the Controller with reasonable information needed for a data protection impact assessment or prior consultation with a supervisory authority, to the extent the Controller does not otherwise have access to it.
11.1 During the Main Agreement the Controller can export and delete Personal Data itself using the functions of the Service.
11.2 After the Main Agreement ends, the Account stays available read-only for 30 days so the Controller can export its data. The Processor then permanently deletes Personal Data from the production systems within a further 60 days, unless EU or member state law requires storage.
11.3 Copies in backups are deleted as the backups expire in the normal rotation and are not restored except for disaster recovery, after which deletions are applied again.
11.4 On request the Processor confirms the deletion in writing.
12.1 The Processor makes available all information necessary to demonstrate compliance with Article 28 GDPR, primarily through this DPA, the security page, and answers to reasonable security questionnaires.
12.2 If that information is not sufficient, the Controller may have an audit carried out, at most once per year, by an independent auditor bound by confidentiality, with at least 30 days' notice, during business hours and without disrupting the Service or compromising other customers' data. The Controller bears the costs of the audit, unless it reveals a material breach of this DPA by the Processor.
The liability of the parties under this DPA is subject to the limitations of the Main Agreement, except where the GDPR does not allow such limitation.
14.1 This DPA applies for as long as the Processor processes Personal Data on behalf of the Controller.
14.2 In case of conflict between this DPA and the Main Agreement regarding the protection of personal data, this DPA prevails.
14.3 This DPA is governed by the laws of the Netherlands; disputes are submitted to the competent court in Amsterdam.
Subject matter and duration. Provision of the PPS ERP cloud platform for the duration of the Main Agreement and the export and deletion period after it.
Nature and purpose. Storing, organising, retrieving, displaying, combining, calculating with, exporting, transmitting to connected Integrations, and deleting data, in order to provide the ERP functions the Controller uses: products and inventory, sales and invoicing, purchasing, customers (CRM), suppliers, point of sale and stores, human resources and payroll, marketplace and web-shop integrations, reporting, notifications and support.
Categories of data subjects.
Categories of personal data.
Special categories. The Service is not designed for special categories of personal data (Article 9 GDPR). The Controller should not record health information — for example medical reasons for leave — in free-text fields. Where national identification numbers are processed, the Controller ensures a legal basis exists (in the Netherlands, for example, for payroll purposes).
Frequency. Continuous, for the duration of the Main Agreement.
Location. European Union (EU/EEA); see Annex 3 for sub-processors.
The measures published on our security page, in the version in force at the relevant time, form Annex 2 of this DPA.
The sub-processors published on our sub-processor page, in the version in force at the relevant time, form Annex 3 of this DPA.
Questions about this policy?
Contact us at info@ppserp.com.