Data Processing Agreement (AVV)

This Data Processing Agreement ("DPA") forms part of the Terms of Service and reflects the requirements of Art. 28 GDPR. It applies where Elevon B.V. ("Processor") processes personal data on behalf of a customer ("Controller") in providing the platform.

1. Roles and scope

The Controller determines the purposes and means of processing business data it uploads or connects. The Processor processes such data only on documented instructions from the Controller (Art. 28(3) GDPR). The Controller is responsible for lawful collection and for having a valid legal basis for any personal data it provides.

2. Subject matter, duration, nature and purpose

• Subject matter: provision of the AI-powered business intelligence platform.
• Duration: for the term of the applicable subscription.
• Nature: hosting, storage, and automated analysis of business data.
• Purpose: to deliver insights, reports and recommendations to the Controller.
• Categories of data subjects: the Controller's customers, employees and contacts whose data is included in uploaded business data.

3. Processor obligations

• Process personal data only on documented instructions, including transfers to third countries, unless required by EU or Member State law (Art. 28(3)(a) GDPR).
• Ensure persons authorised to process are bound by confidentiality (Art. 28(3)(b) GDPR).
• Implement technical and organisational measures under Art. 32 GDPR (see our Security Policy).
• Respect the conditions in Art. 28–36 GDPR for engaging sub-processors.
• Assist the Controller with data subject rights requests and obligations under Arts. 32–36.
• Delete or return personal data after the end of services, and delete existing copies unless law requires storage.
• Make available information to demonstrate compliance and allow audits (Art. 28(3)(h)).

4. Sub-processors

The Controller grants general authorisation for the sub-processors listed in our Sub-Processors list. We will inform the Controller of intended changes, giving the Controller the right to object (Art. 28(2) GDPR).

5. Security measures

We implement measures including encryption in transit and at rest, role-based access control, row-level isolation, logging, and regular review. Details are in our Security Policy.

6. Personal data breach

In the event of a personal data breach, the Processor will notify the Controller without undue delay and provide information to allow the Controller to meet its breach-notification obligations under Art. 33 GDPR (notification to the supervisory authority within 72 hours).

7. International transfers

Where sub-processors transfer data outside the EEA, the Processor relies on Standard Contractual Clauses (Art. 46 GDPR) or an adequacy decision and applies supplementary measures.

8. Audit rights

The Controller may audit compliance after reasonable notice. Where possible, the Processor will provide independent audit reports (e.g. SOC 2 / ISO 27001) to satisfy audit obligations.

9. Deletion on termination

On termination, the Processor will delete the Controller's business data within 30 days, unless EU or Dutch law requires longer retention.

10. Governing law

This DPA is governed by Dutch law. Disputes are submitted to the competent court of Amsterdam, the Netherlands.