Legal
Data processing agreement
Agreements on personal data of visitors to your website and of your email.
This is an English convenience translation. The Dutch version is the legally binding text and prevails if there is any difference. Read the Dutch version.
Version 1.0. Last updated: 23 October 2026.
This data processing agreement forms part of every agreement with Klappe Development (Klappe Hosting) and is part of the terms and conditions. You do not have to sign anything: the agreement applies from the moment you become a customer. If you want your own signed copy, ask us.
Article 1. Definitions and roles
1.1 Customer: anyone who takes a plan or an add-on from Klappe Development. Processor: Klappe Development, located at Boersenserf 10, 3871 RK Hoevelaken. Dutch Chamber of Commerce (KvK) number: 71434577.
1.2 The terms personal data, processing, controller, processor, data subject, personal data breach and sub-processor have the meaning given in the General Data Protection Regulation (GDPR).
1.3 For personal data that the customer places on our services or processes through our services, the customer is the controller (or, if the customer does so on behalf of a client, the processor) and we are the processor (or sub-processor). This does not apply to our own customer administration: for that we are responsible ourselves, see the privacy statement.
Article 2. Subject matter and duration
2.1 We process personal data solely to provide the agreed service: hosting websites, receiving, storing, forwarding and delivering email, making backups and providing support.
2.2 This concerns the types of data and data subjects in the annex. The customer decides which data he places on the service himself.
2.3 The agreement applies for as long as we process personal data for the customer, that is, as long as the hosting agreement runs and until the data has been returned or deleted (article 11).
Article 3. Customer's instructions
3.1 We process personal data only on the basis of written instructions from the customer. The agreement, the terms and conditions and this data processing agreement constitute the instructions. The customer gives additional instructions in writing, and we carry them out within reason.
3.2 If we are of the opinion that an instruction infringes the GDPR, we will report this immediately.
3.3 The customer ensures that he has a legal basis for his processing, that data subjects are informed (for example through his own privacy statement and cookie banner) and that he complies with his own obligations under the GDPR. We do not process data for our own purposes.
Article 4. Security
4.1 We take appropriate technical and organisational measures, taking into account the state of the art, the costs and the risk. These include at least:
- encrypted connections (TLS) for websites, the panel and email;
- protected servers, access only for those who need it, with strong passwords or keys and two-step verification where possible;
- separate accounts per customer, so that customers cannot see each other's files;
- regular updates of server software and security patches, and with Maintenance also of WordPress, plugins and themes;
- protection against attacks through Cloudflare, such as a firewall and DDoS protection;
- backups at a separate location outside the server itself, on a best-efforts basis;
- logging of administrative actions and monitoring for misuse;
- physical security at the data centre, provided by our hosting partner;
- confidentiality of staff and engaged helpers (article 7).
4.2 Security is an obligation of best efforts. We cannot guarantee that data will never be lost or fall into the hands of unauthorised persons. The customer is himself responsible for the security of his website (such as strong passwords, up-to-date plugins if he does not take Maintenance, and secure code).
4.3 We evaluate the measures regularly and adjust them if the risk changes. We will not significantly lower the level of protection without informing the customer.
Article 5. Sub-processors
5.1 The customer gives us general authorisation to engage the following sub-processors:
| Sub-processor | Purpose | Location | Data |
|---|---|---|---|
| Contabo | Hosting: servers on which websites, databases and files are stored | Germany, EU | Customer's files, databases and log files |
| Cloudflare | DNS, email forwarding (Email Routing), CDN and website protection | Worldwide, with US parent company | Visitor traffic data (such as IP address), forwarded email, DNS data |
| Cloudflare (Workers, D1, Turnstile) | Our own website, the database with orders and the spam filter on forms | Worldwide, with US parent company | Customer's order and account data (only for our own administration, see the privacy statement) |
| MXroute | Mailboxes | United States or EU, depending on the chosen server | Mailboxes, email messages and attachments |
| Moneybird | Invoicing and administration | Netherlands, EU | Customer's name, address, email address, IBAN and invoice data |
| Emailit | Sending transactional email (for example confirmations and notifications) | EU or US, depending on the sending route | Email address and content of messages from our systems |
| Meta (WhatsApp) | Support chat with the customer, also via our helpdesk (Balie, a system of the processor itself) | Worldwide, with US parent company | Phone number, name, messages and attachments that the customer sends |
| Provider of backup storage | Encrypted backups of websites at a separate location | EU | Backups of the customer's files and databases |
5.2 We impose on each sub-processor the same data protection obligations as in this agreement, to the extent reasonably possible. With large suppliers this is often done through their standard data processing terms. We remain responsible towards the customer for the performance of our sub-processors.
5.3 If we want to add or replace a sub-processor, we will inform the customer in writing at least 1 month in advance. The customer can raise reasonable objections within 14 days. If we cannot work it out, the customer may terminate the agreement with effect from the date on which the change takes effect.
5.4 The list on this page is the current list. The date at the top shows when it was last updated.
Article 6. Transfers outside the EU
6.1 We process personal data within the European Economic Area as much as possible. Some of our sub-processors (in particular Cloudflare and Meta) are established in the United States or may process data there.
6.2 For that transfer, safeguards apply such as the EU-US Data Privacy Framework, to the extent the sub-processor is certified for it, and otherwise the standard contractual clauses of the European Commission, supplemented with appropriate measures.
6.3 We make other transfers outside the EEA only on the basis of an instruction from the customer or a legal obligation, and with an appropriate safeguard under Chapter V of the GDPR.
Article 7. Staff and confidentiality
7.1 Only persons who need access to provide the service may process personal data. They are bound by confidentiality.
7.2 We only look at the customer's data when that is necessary for the service, such as an incident, a request from the customer, a backup or misuse.
7.3 We only give personal data to third parties if the customer has instructed us to do so or a law or court requires it. If the law permits, we will inform the customer beforehand.
Article 8. Data breaches
8.1 If we discover a security breach that leads to the destruction, loss, alteration or unauthorised disclosure of, or access to, the customer's personal data, we will report it to the customer as soon as possible and at the latest within 48 hours after we discovered it.
8.2 The report is sent by email and, where possible, also via WhatsApp to the customer's contact address, and contains as much as possible of the following: the nature of the breach, the data and data subjects concerned (roughly), the likely consequences, what we have done and what the customer can do, and a contact person. If information is missing, we will supplement it as soon as we have it.
8.3 The customer assesses whether he must report the breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (within 72 hours) and to data subjects. We cooperate with this and take measures to limit the breach and prevent recurrence.
8.4 We keep a record of all personal data breaches, with the facts, the consequences and the measures taken.
8.5 The customer can report a suspected data breach via [email protected] or WhatsApp (Monday to Sunday, 9:00 to 21:00). Outside those hours we read the report the next day, and these 48 hours then start running from the moment we know about it.
Article 9. Rights of data subjects
9.1 If we receive a request from a data subject (access, correction, erasure, restriction, portability or objection) about data that we process for the customer, we do not answer it ourselves but refer the data subject to the customer and inform the customer without undue delay.
9.2 We help the customer within reason to answer such requests. If that help takes more than a small number of hours, we may charge reasonable costs after consultation.
9.3 We also help the customer within reason with security, notifications of data breaches, data protection impact assessments and prior consultation of the supervisory authority, to the extent that concerns our service and with the information we have.
Article 10. Audit and inspection
10.1 We make available to the customer all information necessary to demonstrate that we comply with this agreement. We normally do this in writing, by answering questions and sharing available documentation.
10.2 If that is not sufficient, the customer may once a year, or more often in the case of a specific reason such as a data breach, have an audit carried out by an independent expert who is bound by confidentiality. The customer gives written notice of this at least 4 weeks in advance. The audit does not unreasonably disrupt our service and other customers and does not give access to data of other customers or to security-sensitive information of third parties.
10.3 The costs of the audit are borne by the customer. If the audit finds a material failure on our part, we will remedy it as soon as possible, at our own cost. To the extent our sub-processors (such as Contabo and Cloudflare) are themselves audited, we may refer to their certificates and audit reports.
Article 11. Return and deletion
11.1 After the end of the agreement, the customer can export his data for 30 days, such as files, databases and email (see also article 19 of the terms and conditions). We help with this on request.
11.2 After those 30 days we delete the customer's personal data from our systems and have the sub-processors do the same, unless the law requires retention. Backups disappear according to their own cycle, at the latest within 90 days after that.
11.3 On request we confirm in writing that the data has been deleted.
11.4 If the customer wants us to delete earlier, this is possible on written request, at the customer's own risk if he still needs the data.
Article 12. Liability and final provisions
12.1 For liability under this agreement, the provisions of article 20 of the terms and conditions apply, including the limitations. Fines imposed on the customer by a supervisory authority are for the customer's account, to the extent the law permits and unless they are the result of intent or wilful recklessness on our part.
12.2 In the event of a conflict between this data processing agreement and the terms and conditions, this data processing agreement prevails, as far as personal data is concerned.
12.3 This agreement is governed by Dutch law. Disputes are submitted to the competent court in accordance with article 25 of the terms and conditions.
12.4 We may amend this agreement in accordance with article 23 of the terms and conditions, for example because of changes in the law or a new sub-processor.
Annex: data and data subjects
| Item | Content |
|---|---|
| Nature and purpose of the processing | Storing, transferring, delivering, backing up, securing and restoring the customer's websites and email, and support for these. |
| Types of personal data | Everything the customer places on the service or has processed himself. Usually: name, address, email address, phone number, login details, IP addresses, messages and attachments, data from forms and orders. The customer decides himself which data this is. |
| Special categories of personal data | Not intended. If the customer nevertheless processes special categories of data (such as health data) or criminal data, he reports this in advance, so that we can determine whether our security is appropriate. |
| Categories of data subjects | Visitors to the customer's website, the customer's customers and leads, the customer's employees, and anyone who emails with the customer. |
| Duration | The term of the agreement plus the export period of 30 days and the backup cycle (at the latest 90 days after that). |
| Contact for privacy and data breaches | [email protected] or WhatsApp (Monday to Sunday, 9:00 to 21:00). |