Data processing agreement

dpa-2026-10-29-v7

Dustless | eenmanszaak | Stelhout 5, 3991 PD Houten, NL | KVK 97524549 | VAT NL005275384B13

Parties and scope

The customer named in the acceptance record is controller of its business and staff data; Dustless, sole proprietorship, Stelhout 5, 3991 PD Houten, KVK 97524549, contact@dustless.nl, is processor. This includes free trials and lasts while Dustless processes those data. Dustless is a separate controller for its own account security, billing and statutory records; see the privacy policy. Other Dustless services are not automatically covered.

Instructions and responsibility

Dustless acts only on documented instructions, including permitted settings, except where legally required; it gives prior notice unless prohibited by law. It immediately warns of suspected unlawful instructions and suspends only that processing. The customer determines lawful basis, notices, applicable collective agreement and roles. Dustless retains its own GDPR, security and statutory liability obligations.

Annex A — processing

Purpose and operations: storage, organisation, display, changes, notifications, export and erasure for selected portal modules. Subjects: employees, administrators, customer/location contacts and suppliers. Data: work identity and contact, roles, contract and collective-agreement terms, planning, availability, leave without medical reasons, hours and reviews, quotes, locations, materials, work notes, permitted documents and related history. Do not enter medical files, national identification numbers, identity copies, criminal or other special-category data. No advertising, sale of data or AI model training.

Annex B — security and confidentiality

Only instructed persons bound by confidentiality receive necessary access. Measures: HTTPS, tenant separation and server checks, least privilege, hashed passwords/sessions, MFA using an authenticator app (required for all portal users and Website administrators, optional for ordinary customer accounts), validation and private document downloads, integrity checks and consistent backups. Dustless reviews risks and measures periodically and after incidents. No ISO certification, antivirus guarantee or claim that all storage and USB copies are encrypted. New own data backups are stored only on a connected, unlocked Kingston with verified encryption. The computer retains necessary technical recovery references; older copies require separate review. Private GitHub storage is only for selected source code, not databases or personnel data. Access and erasure for each storage location must be demonstrably controlled before customer release.

Existing hosting agreements

mijn.host B.V., Pietersbergweg 291, 1105 BM Amsterdam, Netherlands; privacy@mijn.host. The October 2026 processing and subprocessing agreements with annexes accepted by Dustless form the hosting basis. For customer content Dustless is processor and mijn.host subprocessor; Dustless has a separate controller role for its own account and fiscal administration. The service confirmation of 29 October 2026 specifies hosting, SMTP, recovery and support. Accepting this agreement does not activate payment, a subscription or additional modules.

Annex C — subprocessors and transfers

Direct subprocessor: mijn.host B.V. For h47: Voxility GmbH, Messeturm, Friedrich-Ebert-Anlage 49, 60308 Frankfurt am Main, Germany (hosting infrastructure in the EU); Leaseweb Netherlands B.V., Hessenbergweg 95, 1101 CX Amsterdam (backups in the Netherlands). mijn.host operates application, database, SMTP and security; no additional external SMTP provider. AI ticket support: Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco CA 94104, USA (Claude), and Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland (Gemini); US transfers under SCCs and hosting agreement article 10. Tickets, contact details and necessary sanitised technical context may be processed; do not provide personnel files, database dumps, secrets or login links. No EEA-only or ZDR guarantee is given for the support flow. Identity, role and contact: https://mijn.host/trust/subverwerkers and privacy@mijn.host. Other listed hosting, Microsoft365 or domain providers are not automatically recipients of portal content. Dustless notifies customers directly before new or replacement subprocessors, with genuine objection, alternative or termination before use. The host gives at least 14 days’ advance notice in its control panel; Dustless checks daily and forwards without undue delay. This does not guarantee customers the full 14 days. Chosen Google/Microsoft login and Stripe payments have separate purpose-specific roles.

Assistance, incidents and audit

Dustless assists with data-subject rights, security, DPIAs and supervisory consultation according to processing and available information. Direct requests are forwarded without undue delay, not independently decided for the customer. Breaches are reported to the company contact without undue delay, where possible within 24 hours of awareness, with updates. The customer assesses the statutory 72-hour notification. Dustless provides compliance information and enables necessary customer or authorised-auditor inspections while protecting other customers and security. Scheduling or fees cannot obstruct statutory rights or urgent scrutiny.

Annex D — switching and export

Only the Head company administrator may request full export or termination through the protected route with identity reauthentication. If unavailable, write to contact@dustless.nl for verified authorised representation. No new DPA is required to exercise existing statutory rights. Switching to another provider or own infrastructure: no additional switching notice, transition without undue delay within 30 calendar days of request, with continuity, reasonable assistance and security. Only lawful technical exceptions are justified promptly; a longer transition may be agreed at the customer’s request. Afterwards at least 30 calendar days are available solely for retrieval. No export or switching fee. Ordinary subscription cancellation and any remaining payment obligations are separate, subject to mandatory law.

Export format and boundaries

Export format: a private TAR.GZ archive with UTF-8 JSON/NDJSON (one JSON object per line), field dictionary, relationships, time-zone/date conventions and original files with name, type and SHA256 manifest. Only the Head company administrator downloads after reauthentication. It contains company-owned records and relevant history in present modules, excluding other tenants, private profile addresses, carts, password hashes, sessions, tokens, OAuth/MFA secrets and reusable payment links. Applicant contacts supplied to this company remain in its records. External actor IDs are not enriched with private profiles. Unsafe relationships, damaged files or unreviewed schemas block the full export. Local limit: 512 MiB, 250,000 records or 20,000 files; larger transfers via contact@dustless.nl without truncation. Existing hours CSV export remains separate. No guarantee of direct import into every provider. The user verifies the saved download before confirming handover complete.

Return, erasure and retention

The customer chooses return followed by erasure or erasure without return, and may change that choice before execution. At the end of the agreed retrieval window, operational customer data and existing copies are erased without undue delay; switching retrieval lasts at least 30 calendar days. There is no general legal duty to retain staff files or backups for a further 90 days. No indefinite retention. Only specifically required statutory records remain separately, access-restricted, with legal basis and end date. Dustless normally retains its own fiscal basic records for seven years, longer for statutory exceptions; that does not justify keeping all customer staff data. Customers remain responsible for their own records and timely export. Shared sign-in accounts and other Dustless services are not automatically deleted.

Backups and execution evidence

Dustless deletes per storage location and uses an independent deletion register to prevent reactivation after restoration. Hosting backups expire by rotation: 30 days of active retention is confirmed for Hosting Starter; the agreement allows up to 90 days for other recovery copies/archives unless a shorter period is recorded. No immediate targeted erasure from existing provider snapshots is promised. Remaining copies stay restricted and are not used for ordinary service; the current deletion register is applied before restored service opens. Each termination records inventory, transfer/customer check, retrieval deadline, legal exceptions/end dates, deletion per location, remaining copies and expected rotation. Blocking or operational deletion does not prove every copy is gone. Completion is confirmed only with appropriate evidence; this agreement itself starts no deletion or backup task.

Precedence and changes

This agreement and annexes prevail over conflicting subscription privacy provisions. Dutch text prevails, subject to mandatory Dutch/EU law. Changes are not retroactive: new version and separate acceptance with company identity, language, time and integrity evidence. Prior acceptance is never invented. Return/erasure, confidentiality and necessary audit obligations survive until settled.

Execution and status

The workflow records receipt and transfer completion separately. When switching, at least 30 calendar days for retrieval start only after confirmed completion; company data then remain available solely for retrieval. An express instruction to erase without return is different and does not fabricate receipt. The Head company administrator reconfirms permanent erasure with password and two-factor authentication. Only the own operational company context is erased. Subscription termination and specific fiscal settlement are checked separately; an outstanding claim does not justify blanket retention of personnel files. Dustless fiscal base records use a verified actual starting date and the normal seven-year period; any special longer statutory period requires separate review. Expired retention requires review and disposal, not indefinite extension. Personal accounts and other services are not automatically deleted. An independently secured register contains only necessary references, checksums, dates and copy statuses, not personnel documents. It is needed while restores could revive erased data; afterwards this limited evidence must also be erased or anonymised unless a specific own legal basis requires further retention. Operational erasure is not proof that all backups are erased. Completion remains pending until each storage location has been demonstrably checked.