1. Parties and scope
This agreement applies between the client identified in the service agreement (the controller) and the contracting party identified there, trading as Web and Brand (the processor). These terms have the meanings given in the General Data Protection Regulation (GDPR).
This agreement applies only to personal data that Web and Brand processes on the client's behalf when providing the agreed services. It does not apply to processing for which Web and Brand determines the purposes and means itself, such as its own administration.
2. Instructions and purposes
Web and Brand processes personal data only on the client's documented instructions and for the agreed services. This may include setting up, hosting, maintaining or supporting websites and digital applications. The applicable work and purposes are specified in the service agreement or a short schedule.
Web and Brand does not use this data for its own marketing, sales or AI model training. Additional instructions are documented in writing. If a legal obligation requires processing, Web and Brand informs the client in advance unless the law prohibits this. Web and Brand immediately informs the client if, in its opinion, an instruction infringes the GDPR or other applicable data protection rules, and suspends that instruction until it can be carried out lawfully.
The client determines the lawful basis, provides data subjects with accurate information, and supplies only lawful and necessary data and instructions.
3. Data and client schedule
Depending on the assignment, processing may involve names and contact details, account details, form submissions, order details and technical data such as IP addresses and logs. Data subjects may include the client's visitors, customers, employees or contact people. These examples do not authorise every type of processing listed.
Before processing begins, the parties record the following in the service agreement or a short schedule:
- the identity and contact people of both parties, including the personal data breach contact;
- the subject matter, nature, purposes and duration of processing;
- the categories of personal data and data subjects;
- the applicable security measures, retention periods and backup cycles;
- the subprocessors, their activities and processing locations, including any international transfers and safeguards;
- the arrangements for returning and deleting data on termination.
Special categories of personal data and criminal offence data fall outside the assignment unless the parties expressly document this processing in advance and agree appropriate additional protection.
4. Security and confidentiality
Web and Brand implements and maintains appropriate technical and organisational measures under Article 32 GDPR. The level of protection reflects the nature of the data, processing risks, state of the art and implementation costs. The specific measures are documented in the client schedule before processing begins and reviewed periodically for effectiveness.
The parties consider access restrictions, secure authentication, encryption where appropriate, maintenance and security updates, logging, backups, recovery and incident handling. Access is limited to authorised people who need it for their work and are bound by confidentiality. That duty continues after termination.
5. Personal data breaches
Web and Brand informs the client without undue delay after becoming aware of a personal data breach within this assignment. It does not wait for a full investigation. The initial notification goes to the agreed breach contact; further information follows as it becomes available.
As far as known, the notification includes the nature of the incident, the data and people affected, likely consequences, measures taken or proposed, and a contact point. Web and Brand investigates the incident, limits its effects, documents its handling and assists the client with its notification obligations.
The client assesses and handles notification to the supervisory authority and, where necessary, data subjects. The client's statutory period, normally 72 hours, is not a waiting period for Web and Brand. The parties may agree a shorter operational notification period in the schedule.
6. Rights, assistance and oversight
Taking account of the nature of processing, Web and Brand assists the client with requests for access, rectification, erasure, restriction, portability and objection. Any request received directly is forwarded to the client without undue delay. Web and Brand handles it only on the client's instructions unless the law requires otherwise.
Web and Brand assists the client with security, breach notifications, data protection impact assessments (DPIAs) and prior consultation with the supervisory authority, taking account of the nature of processing and the information available.
Web and Brand provides all information needed to demonstrate compliance with this agreement and Article 28 GDPR. It allows and assists with audits and inspections by the client or its independent auditor. The parties agree timing, confidentiality and protection of other clients; these arrangements must not prevent necessary oversight. Any cost arrangements do not limit the statutory duty to assist.
7. Subprocessors
Web and Brand appoints subprocessors only with the client's prior specific or general written authorisation. The client schedule lists the authorised parties, their roles and locations. A supplier engaged directly by the client is not automatically a subprocessor of Web and Brand.
Under general authorisation, Web and Brand gives the client advance written notice of a proposed addition or replacement, with sufficient information and time to object before the new party is used. The parties seek to resolve a reasoned privacy objection. Until it is resolved or specific authorisation is given, the new party does not process client data. If no solution is found, the parties discuss an alternative or termination of the affected service.
Web and Brand imposes at least the same data protection obligations on the subprocessor and remains responsible to the client for their performance.
8. International transfers
Processing outside the European Economic Area (EEA), including access from a third country, takes place only on the client's documented instructions and in compliance with Chapter V GDPR. The countries, recipients and safeguards are recorded in the schedule beforehand.
Where applicable, the parties assess an adequacy decision or appropriate safeguards, such as standard contractual clauses, the transfer risks and any necessary supplementary measures. Authorisation of a subprocessor is not, by itself, a valid basis for a transfer. Without sufficient protection, the transfer does not take place or is suspended.
9. Duration and retention
This agreement applies throughout the instructed processing and remains applicable while Web and Brand holds personal data for the client. The client determines retention periods; Web and Brand does not retain data longer than required for the assignment or a legal obligation.
For each relevant data category, the parties document the retention period or its determining criterion, including for logs and backups. Backups are available only for security and recovery, have restricted access and are overwritten according to the agreed cycle. After recovery, previous deletions are reapplied.
10. Return and deletion
On termination, Web and Brand returns or deletes the personal data at the client's choice and deletes existing copies, unless a legal retention duty prevents this. The format, transfer method and completion period are agreed in the schedule beforehand. Data is returned securely in a usable format.
Where immediate deletion from backups is technically impossible, the data is taken out of use and deleted according to the documented backup cycle. If retention is legally required, Web and Brand informs the client of the basis and period, as far as permitted, and limits processing to that obligation. On request, Web and Brand confirms completion in writing.
11. Changes and precedence
A new website version does not automatically change existing agreements. Web and Brand announces changes in writing in advance, stating the version, date, content and intended effective date. For an existing client, changes apply only after written or electronic acceptance, except for directly applicable legal obligations. Without acceptance, the previously agreed version continues while it can lawfully be performed.
For personal data, this agreement takes precedence over conflicting general terms. The service agreement or schedule specifies the assignment and may contain express variations or additions, as far as the GDPR permits. Mandatory law prevails.
12. Acceptance and contact
The parties accept this agreement in writing or electronically, for example in the service agreement, with an express reference to version 2.1 of 18 September 2026 and the accompanying client schedule. Both parties must be able to retain the accepted text in a durable form. Merely visiting this page or using a service does not constitute acceptance.
Questions or instructions about this agreement may be sent to info@webandbrand.nl. For incidents, the parties use the breach contact identified in the service agreement or schedule.
Legal framework: General Data Protection Regulation, in particular Articles 28 and 32–36 and Chapter V.