Data processing agreement

Riffle processes personal data solely in order to deliver the Platform: processing work orders, hours, email and calls, and exchanging data with Syntess. Riffle processes no personal data for its own purposes.

Riffle records no location data about staff. Special categories of personal data and citizen service numbers (BSN) are not intended to be processed. The Customer makes sure they do not end up in the Platform unnecessarily. The Customer is responsible for having a valid legal basis and for informing data subjects, for instance that calls are processed.

1. 1.Riffle processes only on the basis of the Agreement and the Customer’s written instructions. If Riffle finds an instruction to be in breach of the GDPR, it says so immediately.
2. 2.Everyone who has access to personal data on Riffle’s behalf is bound to confidentiality.

Riffle takes appropriate technical and organisational measures (GDPR art. 32), including:

• Encryption of data in transit (TLS) and at rest
• Hosting and storage inside the EU
• Logical separation of data per customer (row-level security)
• Access on a need-to-know basis, with two-factor authentication for Riffle staff
• Daily backups, and logging of access to production systems

The Customer gives general authorisation for the subprocessors below. Riffle announces a new or replacement subprocessor at least 30 days in advance; within that period the Customer may object and terminate the Agreement. Riffle imposes on its subprocessors the same obligations as in this annex.

These parties have a parent company in the US. For any transfer outside the EEA Riffle puts appropriate safeguards in place, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. Riffle buys AI services only on business terms under which Customer Data is not used to train models.

Riffle assists the Customer, as far as is reasonable, with data subject requests (access, correction, deletion) and with a DPIA or a prior consultation of the Dutch data protection authority, the Autoriteit Persoonsgegevens. A request that reaches Riffle directly is passed on to the Customer.

Riffle reports a personal data breach to the Customer without undue delay, and within 48 hours of discovering it at the latest. The report states what is known about its nature, its scale, the data subjects, the consequences and the measures taken. The Customer decides on notifying the Autoriteit Persoonsgegevens and the data subjects.

On request Riffle gives the Customer the information needed to demonstrate compliance. Once a year at most, on 30 days’ notice and at its own cost, the Customer may have an audit carried out by an independent expert who is bound to confidentiality.

1. 1.While the Agreement runs, Riffle keeps personal data for as long as the service needs it. That includes voice notes, call recordings and photographs: they belong to the work order they were made for. The Customer may instruct Riffle to delete them sooner.
2. 2.After the Agreement ends, Riffle makes data available for export on request within 30 days. Riffle deletes all personal data no later than 60 days after it ends, and from backups within 90 days, unless a legal obligation to retain it applies.

Article 7 of the terms and conditions applies to liability under this annex.