Data Processing Agreement

When a separate agreement is needed

Some assignments may require Virtus Optio to process personal data on a client's behalf, for example when working in the client's customer relationship management system. Where Virtus Optio acts as a processor, the parties must agree a written Data Processing Agreement before that processing begins.

The agreement must describe the actual assignment and the safeguards that apply. This page explains the arrangements; it does not replace the client-specific agreement. Ordinary enquiry and invoicing records are covered by the Privacy Policy, rather than automatically being treated as processing on a client's behalf.

What the agreement covers

The client-specific agreement will address:

• The parties, subject matter, purpose, duration and nature of the processing, the types of personal data and the people concerned.
• The client's documented instructions, including any instructions about transfers outside the European Economic Area, and what happens if an instruction appears to infringe data protection law.
• Confidentiality obligations for everyone authorised to access the data.
• Appropriate technical and organisational security measures for the actual systems, access and risks involved.
• Prior authorisation of subprocessors, equivalent data protection obligations and responsibility for their work.
• Assistance with individuals' privacy rights, security obligations, personal data breaches, impact assessments and consultations with regulators, as applicable.
• Notification of a personal data breach to the client without undue delay after becoming aware of it, with further cooperation and information as required.
• Return or deletion of personal data and copies at the end of the assignment, at the client's choice, unless the law requires retention.
• The information and audit arrangements needed to demonstrate compliance.

Assignment details

Before processing starts, the parties need to record the relevant systems, access permissions, data categories, processing locations, any subprocessors, actual security measures, retention and deletion arrangements, and incident contacts. Any international transfers need the safeguards required by the GDPR.

These details depend on the assignment. They are not assumed merely because a client contacts Virtus Optio or reads this page.

Request an agreement

Email [email protected] to discuss the data processing requirements for your assignment. You can also contact us on WhatsApp: +31 6 16125169. Please do not send customer databases or sensitive personal data with your initial enquiry.

Virtus Optio · KVK number 95111492.

Further information

See the European Commission's controller–processor model clauses and the Dutch Data Protection Authority's guidance on processing agreements.