Data processing terms

• These data processing terms govern how Hometwin processes personal data on behalf of Customer, as referred to in Article 28 of the General Data Protection Regulation (GDPR).
• They form part of every Agreement between Hometwin and Customer. The parties do not need to sign them separately: they apply once the Agreement is concluded.
• In the event of a conflict, these data processing terms prevail over the general terms and conditions, insofar as the processing of personal data is concerned.

• Terms from the GDPR, such as personal data, processing, controller, processor, data subject and personal data breach, have the meaning the GDPR gives them.
• Capitalised terms not defined here, such as Customer, Participant, Agreement and Platform, have the meaning given in the general terms and conditions.
• Customer Data: the personal data Hometwin processes on behalf of Customer, as described in annex 1.
• Sub-processor: a third party engaged by Hometwin that processes Customer Data in that engagement.

• For Customer Data, Customer is the controller and Hometwin is the processor.
• For a Participant's account and home record, Hometwin is itself the controller, under the privacy statement. That data is not covered by these data processing terms.
• Data a Participant shares with Customer is used by Customer under its own responsibility.
• Customer warrants that it processes Customer Data lawfully and may provide it to Hometwin, and that it informs the data subjects about this.

• Hometwin only processes Customer Data on Customer's written instructions, unless a legal obligation requires otherwise. In that case Hometwin informs Customer of that obligation beforehand, unless the law prohibits this.
• The Agreement, these data processing terms and Customer's use of the Platform together constitute Customer's instructions. Customer gives additional instructions In writing; insofar as they fall outside the Agreement, the parties may agree a fee for them.
• If Hometwin considers an instruction to breach the GDPR or other privacy legislation, it informs Customer immediately.
• Hometwin does not use Customer Data for its own purposes.

• Hometwin only gives access to Customer Data to employees and Sub-processors who need that access to provide the Platform.
• Anyone with access is bound by confidentiality, under an agreement or by law.

• Hometwin takes appropriate technical and organisational measures to secure Customer Data, taking into account the state of the art, the costs, the nature of the processing and the risks to data subjects. The measures are listed in annex 2.
• Hometwin may adjust the measures, as long as the level of security does not decrease as a result.

• If Hometwin discovers a personal data breach affecting Customer Data, it notifies Customer without undue delay and no later than 48 hours after discovery.
• The notification includes, as far as known: the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures Hometwin has taken or proposes, and a contact person. Hometwin adds what is not yet known as soon as it becomes known.
• Hometwin immediately takes measures to limit the consequences and helps Customer notify the Dutch Data Protection Authority and data subjects. Customer decides whether and how to notify.
• A notification by Hometwin is not an acknowledgement of fault or liability.

• Customer gives Hometwin general authorisation to engage Sub-processors. The current list is in annex 3.
• Hometwin imposes on each Sub-processor, in writing, at least the same obligations as those in these data processing terms, and remains responsible towards Customer for their performance.
• If Hometwin adds or replaces a Sub-processor, it updates annex 3 and informs Customer.

• Hometwin processes Customer Data in the European Economic Area (EEA), unless annex 3 states otherwise for a Sub-processor.
• If Customer Data is processed outside the EEA, this only happens with appropriate safeguards, such as an adequacy decision of the European Commission (including the EU-US Data Privacy Framework) or the standard contractual clauses approved by the European Commission.

• If Hometwin receives a request from a data subject concerning Customer Data, such as a request for access or erasure, it forwards the request to Customer and does not answer it itself, unless Customer asks it to.
• Hometwin helps Customer, insofar as reasonable, to comply with such requests, including through the features of the Platform.

• Hometwin provides Customer with the information Customer reasonably needs for a data protection impact assessment or a prior consultation with the Dutch Data Protection Authority, insofar as it concerns the processing by Hometwin.

• On reasonable request, Hometwin provides Customer in writing with the information needed to demonstrate that it complies with these data processing terms, such as a description of its security measures and answers to a reasonable questionnaire.
• Information about security is confidential, and Customer only uses it to assess compliance.

• After the Agreement ends, Hometwin no longer processes Customer Data, except to delete it.
• Until the end of the Agreement, Customer can request a copy of the Customer Data.
• Hometwin deletes Customer Data within 90 days of the end of the Agreement, including from backups, unless the law requires it to be kept longer. In that case Hometwin only keeps what is necessary and does not process it for other purposes.
• A Participant's account and home record remain, because Hometwin is itself the controller for them.

• The liability of the parties under these data processing terms is governed by the general terms and conditions.

• These data processing terms apply for as long as Hometwin processes Customer Data.
• Hometwin may change these data processing terms in the same way as the general terms and conditions. Changes to annex 3 are made in accordance with article 8.

• These data processing terms are governed by Dutch law. Disputes are settled as provided in the general terms and conditions.

Subject matter and duration

Providing the Platform to Customer, for the duration of the Agreement and the period after it set out in article 13.

Nature and purpose

Storing, organising, consulting and sending Customer Data to invite Participants on Customer's behalf, manage participations and licences, and communicate with Participants through the Platform.

Categories of data subjects

• Participants and people Customer wants to invite.
• Customer's employees who use the portal.

Types of personal data

• Name and email address, and any other data Customer provides with an invitation, such as an address or customer number.
• The status of invitations, participations and licences.
• Messages Customer sends to Participants through the Platform.
• Name, email address and role of Customer's employees with access to the portal.

Special categories of personal data and criminal data do not belong in Customer Data. Customer does not provide them.

• Storage in the EU: data is stored in Google Cloud data centres in the Netherlands and Belgium.
• Encryption: connections are encrypted with TLS; stored data is encrypted.
• Login: users log in with a one-time link sent by email, without a password.
• Access: rights in the portal are granted per role; Hometwin employees only have access when their work requires it.
• Confidentiality: everyone with access to Customer Data is bound by confidentiality.
• Sub-processors: only providers that offer appropriate safeguards, with written agreements.

Google Cloud

• Purpose: hosting the Platform, database and file storage.
• Location: the Netherlands and Belgium.
• Entity: (to be confirmed)

Google Cloud Vertex AI

• Purpose: the Platform's smart features, such as recognising and reading documents.
• Location: European Union.
• Entity: (to be confirmed)

Google Workspace (Gmail)

• Purpose: sending emails, such as invitations and login links.
• Location: Google infrastructure; processing outside the EEA is possible, with appropriate safeguards.
• Entity: (to be confirmed)

Firebase

• Purpose: notifications on phones.
• Location: Google infrastructure; processing outside the EEA is possible, with appropriate safeguards.
• Entity: (to be confirmed)

Google Maps Platform

• Purpose: maps and street views for an address.
• Location: Google infrastructure; processing outside the EEA is possible, with appropriate safeguards.
• Entity: (to be confirmed)

Mollie

• Purpose: handling payments.
• Location: the Netherlands.
• Entity: Mollie B.V.