Legal
Data processing agreement
Translation. This is a translation for your convenience. Only the Dutch version is binding.
This is a first outline, written on the basis of how the software works. The text has not been reviewed by a lawyer, the company has not yet been incorporated and the highlighted details are still missing. No rights can be derived from this text and nothing will be signed on the basis of it.
Version: draft of [DATUM]
A firm that uses Okloq is the controller for its employees’ hours. Okloq is the processor for what is stored in the online service. This agreement sets out what Okloq may and must do with that data, as required by Article 28 of the GDPR. Below is a summary of its content. We will send you the full draft, with annexes, on request.
1. Parties and roles
The agreement is concluded between the firm and Constructim B.V., Antoniusstraat 30, 5038 DK Tilburg, Chamber of Commerce no. 91374693.
- For the data in the service, the firm is the controller and Okloq the processor.
- Okloq does not receive the raw activity on the laptop (program, window title, file path, times). It falls outside this agreement.
- For its own purposes, such as a trial request and invoicing the firm, Okloq is itself the controller. The privacy statement applies to that.
2. What Okloq processes
| Data | How long in the service |
|---|---|
| Approved hours: date, matter number and name, type of work, minutes, description | [PERIOD]. The description is deleted as soon as the entry is in the firm’s software. |
| Accounts: name, email address, role, hourly rate if set; the password only as a derived value | As long as the account exists, plus [PERIOD] |
| Devices: name, app version, last contact | As long as the device is paired, plus [PERIOD] |
| Settings and the integration with the firm’s software; the software’s key encrypted | As long as the integration exists |
| Audit log: sign-ins, changes, remote viewing | [PERIOD] |
| When a specialist helps: version, settings and error log, after the employee has released them | Viewable for half an hour, deleted a day later |
| Calls from the phone system, if the firm connects it | No longer than thirty days |
Okloq uses this data only to provide the service, not for its own purposes.
3. Instructions and confidentiality
Okloq processes the data only on the firm’s instructions. The agreements and the settings the administrator chooses in the portal count as instructions. Everyone who has access on behalf of Okloq is bound by confidentiality.
Okloq is aware that a firm may be bound by professional secrecy, such as the duty of confidentiality of lawyers. Matter names and descriptions may also fall under it. Okloq does not look at them, unless that is strictly necessary to resolve a fault the firm asks it to fix.
4. Security
Okloq takes appropriate technical and organisational measures. The measures built into the software, and what has not yet been done, are described on the page Privacy and security.
5. Sub-processors
The firm gives general authorisation for sub-processors. Okloq announces a new sub-processor [PERIOD] in advance; the firm can object and, if necessary, terminate.
| Sub-processor | Purpose |
|---|---|
| [HOSTINGPARTIJ, EU] | Hosting of the service and the database, in the European Union |
| Google Ireland Ltd | Encrypted backups and sending email from the service |
The firm’s own software, such as Moneybird, Exact Online or Simplicate, is not a sub-processor of Okloq. The firm chooses that software itself, has its own agreement with it and instructs Okloq to transfer the hours. The firm arranges a data processing agreement with that provider itself.
Okloq stores the data in the European Economic Area. [TO BE CONFIRMED ONCE ALL SUPPLIERS ARE KNOWN]
6. Assistance to the firm
- With employees’ requests for access, rectification or erasure. The administrator can do much of this in the portal.
- With the DPIA: Okloq provides a completed example.
- With informing the works council.
7. Data breaches
If Okloq discovers a data breach affecting the firm’s data, Okloq reports it without undue delay, and no later than [PERIOD] after discovery. This allows the firm itself to notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours. The report describes what happened, which data were affected, what Okloq is doing and what the firm can do itself.
8. Audits
The firm can request information showing that Okloq complies with the arrangements, and once a year have an audit carried out by an independent expert. There has not yet been an external security test or certification.
9. Termination
After the agreement ends, the firm can still download the hours for [PERIOD]. Okloq then deletes the data from the service; they disappear from the backups no later than [PERIOD] after that.
10. Liability and governing law
[LIABILITY CLAUSE, TO BE DRAFTED BY A LAWYER] The agreement is governed by Dutch law. Disputes are submitted to the competent court of the [RECHTBANK].
Questions
Would you like to receive the full draft, or do you have questions? Email tim@constructim.nl.