Team data-processing agreement

Parties, scope and instructions

This agreement forms part of the Bring With terms for business Team customers where we process personal data on their behalf. The customer is the controller, or a processor with authority to instruct us; Tim Van Damme BV is its processor or subprocessor. It does not replace our controller responsibilities for our own account, security, billing and legal records.

Processing lasts for the Team service and the subsequent return/deletion and lawful retention period. Its purpose is storing, organizing, sharing and versioning customer-selected context, managing access, and handling proposals. Operations include collection, storage, retrieval, transmission on authorized instructions, restriction and deletion. Data subjects can include the customer's personnel, collaborators and individuals mentioned in content; data types include identity/contact information, preferences, instructions and other personal data the customer submits. The service is not designed as a repository for regulated highly sensitive records; the customer must assess suitability and minimize such information.

We process on documented customer instructions, including authorized service settings and connection selections, unless Union or Member State law to which we are subject requires otherwise. In that case we inform the customer before processing unless that law prohibits this information on important grounds of public interest. We will inform the customer if an instruction appears to infringe applicable data protection law. The customer is responsible for lawful instructions, required notices and the basis for its processing.

Confidentiality, security and assistance

Authorized personnel are bound by confidentiality and access is limited to what their duties require. Measures include HTTPS, access controls, scoped connection permissions, revocation, authentication-factor support, separated operator powers, change review, minimal security logging, and provider backup/recovery controls. No claim of end-to-end encryption or exclusive EEA processing is made. Measures are maintained and adapted to relevant risks without reducing the agreed level of protection.

Taking account of the processing and information available to us, we assist the customer with data-subject requests, security obligations, breach notifications, impact assessments and supervisory consultations. We notify the customer without undue delay after becoming aware of a personal data breach affecting its data and provide available information in stages where necessary. We do not wait for a complete investigation before giving required initial notice.

Subprocessors and transfers

The customer generally authorizes the providers listed at /subprocessors for their stated processing roles. We impose applicable data protection obligations on our subprocessors and remain responsible for their performance as required by Article 28 GDPR. We will inform the customer's designated Team owner by email of intended additions or replacements before the new subprocessor processes that customer's data, with sufficient information and time to raise a reasonable data-protection objection. We aim to give 30 days' notice. Where an upstream provider gives a shorter period, we will notify the customer promptly and preserve a meaningful opportunity to object.

We will resolve a reasonable objection before proceeding with the affected processing or agree an alternative, including ending the affected service with applicable refund and mandatory rights preserved. International transfers require the applicable Chapter V GDPR safeguards described in the provider documentation; a regional hosting hint alone is insufficient.

Return, deletion and evidence

At the end of the service, the customer can export its Team data and instruct deletion through the confirmed Team deletion or support process. We return or delete personal data and delete existing copies as instructed, unless Union or Member State law to which we are subject requires storage. Backup copies expire on their documented schedules and are protected from ordinary use; restoration procedures reapply erasure decisions. Necessary accounting or legal records are retained only for their separate lawful purpose.

We make information reasonably necessary to demonstrate compliance available to the customer and allow and contribute to audits, including inspections, by the customer or an independent auditor it mandates, subject to proportionate arrangements protecting security, confidentiality and other customers' data. These arrangements do not eliminate statutory audit rights. Contact tim@maxvoltar.be to arrange assistance, evidence, instructions or an audit.