# Data Processing Agreement — English Summary

Plain-English summary of `dpa-nl.md` (DPA), version 1.0, effective 30 September 2026. The Dutch text is legally binding.

## Scope

The DPA is a Verwerkersovereenkomst under **art. 28 AVG** between the **Verwerkingsverantwoordelijke** (client) and **Rule Step B.V.** as **Verwerker** (Processor). It applies to all processing of personal data on behalf of the client, for both online services and consulting (when applicable).

## Key takeaways per article

- **Parties.** Client = Verwerkingsverantwoordelijke; **Rule Step B.V. = Verwerker** (R2-fix preserved).
- **Art. 1 — Definitions.** AVG art. 4 terms prevail; CISG excluded; Dutch law applies.
- **Art. 2 — Instructions.** Processing only on documented client instructions (art. 28 lid 1 + lid 3 sub a AVG). Annex A specifies purpose, data, categories.
- **Art. 3 — Confidentiality.** Written confidentiality obligation for all personnel under Rule Step's authority.
- **Art. 4 — Security measures.** Annex C TOMs: AES-256 at-rest, TLS 1.2+ in-transit, RBAC, MFA (no SMS), incident response, pseudonimization, data segregation, business continuity, annual pen-tests.
- **Art. 5 — Sub-processors.** General prior written consent; **30-day objection period**; sub-processor must accept same obligations; Rule Step remains fully liable. **Annex B** lists current sub-processors (incl. Hetzner/EU, Realtime Register, TransIP, Gandi, Proxmox, ICANN, SIDN, payment processor per assignment).
- **Art. 6 — Data subject rights.** Rule Step forwards requests to client within **48 hours**; full assistance within **5 working days**.
- **Art. 7 — Breach notification.** **48 hours** to controller (R2-fix). Content per art. 33 lid 3 AVG. Phased information allowed. Documentation obligation.
- **Art. 8 — Audit rights.** **10 working days** notice. ISO 27001 / SOC 2 Type II certificate may substitute for audit.
- **Art. 9 — Return / deletion.** Client's choice: return (CSV/JSON, art. 20 AVG) or secure deletion. **30 days** after termination. Backups within **90 days**.
- **Art. 10 — International transfers.** EER hosting (Hetzner) is no transfer. Outside EER: **SCC Modules 2 + 3** (Uitvoeringsbesluit 2021/914). **DPF 2023** for US sub-processors, **except ICANN** (not DPF-certified → SCC + TIA required). EDPB 01/2020 TIA per transfer.
- **Art. 11 — Liability.** Art. 82 AVG joint/several liability. Rule Step holds professional liability insurance. AW Art. 9 cap applies.
- **Art. 12 — Duration.** Tied to main contract; client may terminate immediately on material breach / insolvency / unresolved sub-processor objection.
- **Art. 13 — Forum.** Dutch law; B2B Amsterdam; B2C domicile option (Brussel I bis art. 18 lid 1; 6:194 lid 3 sub w BW). Art. 79 AVG betrokkene-recht preserved.
- **Art. 14 — Closing.** Standard contract amendments + assignment restrictions.
- **Annex A — Verwerkingsspecificaties.** Online services: hosting/domain/facturatie. Consulting: only if data on behalf of client. No bijzondere categorieën (art. 9 AVG).
- **Annex B — Sub-processor list.** EU hosting partners, Realtime Register, TransIP, Gandi, Proxmox, **Billing-partner (per assignment — placeholder)**, ICANN (SCC + TIA; NOT DPF), SIDN, payment processor.
- **Annex C — TOMs.** Full security specification.

## Notable adjudications

- **R2-fix preserved:** Rule Step = Verwerker throughout.
- **R2-fix preserved:** ICANN SCC + TIA (NOT DPF).
- **R2-fix preserved:** 48-hour breach notification.
- **K-2 fix:** Art. 18 lid 1 Brussel I bis (not art. 10).
- **D-13:** Billing-partner redacted as placeholder ("per opdracht") pending vendor decision.

For full legal text, see `dpa-nl.md`.