Data processing agreement

1 · Parties, subject and precedence

The client identified in the assignment confirmation acts as controller. Leadhunter B.V., Goese Dieplaan 97, 4463 LA Goes, Dutch Chamber of Commerce number 67665284, acts as processor to the extent it processes personal data on the client’s behalf.

This document governs that processing in research, personal business contact, notes, handover, follow-up and any agreed content or coaching support. It continues for as long as Leadhunter processes data on the client’s behalf.

For conflicting provisions concerning that personal data, this agreement takes precedence over the general terms. Mandatory privacy law always takes precedence. The parties’ actual roles remain decisive. Leadhunter is independently responsible for its own contract, invoicing and security administration.

2 · Instructions and purposes

The client determines purposes and legal bases. Documented instructions include the assignment confirmation, agreed target market, contact approach, access permissions and authorised follow-up requests. Leadhunter processes only within those instructions unless otherwise required by law.

Leadhunter informs the client of an apparently unlawful instruction and may suspend it. A legally required deviation is notified in advance unless prohibited by law.

Data is not sold or used for Leadhunter’s own advertising or other clients. Only genuinely anonymous data is used for internal improvement. A new independent purpose is not treated as covered by these instructions.

3 · Client obligations

The client ensures lawful sources, legal bases, information to individuals and, where required, demonstrable consent for the relevant channel and purpose. It promptly communicates relevant objections and restrictions.

It limits data to what is necessary, designates authorised contacts and handles rights requests. Special-category or criminal-offence data, consumer campaigns or high-risk processing must not be supplied without separate prior arrangements.

The parties record who checks consent, legal form, suppression lists and information duties. This arrangement does not release Leadhunter from its own legal obligations.

4 · People, access and confidentiality

Only people who need data for their tasks receive access, with appropriate personal permissions and statutory or contractual confidentiality duties. Access is withdrawn on departure or a change of duties.

The international team receives access only for agreed delivery. A staff member under direct authority is not a separate subprocessor merely for that reason; an independent service provider may be.

Clients’ data is logically separated. Support and incident investigation do not confer unlimited access. Relevant administrative actions are recorded where appropriate.

5 · Security

Leadhunter implements appropriate technical and organisational measures under GDPR Article 32, considering the processing and risks. Annex 2 describes security principles that must be verified in practice before use.

Measures may change provided protection is not materially reduced. The client protects its own devices and accounts and grants only necessary permissions.

6 · Subprocessors and international transfers

The client gives general written authorisation for subprocessors disclosed in writing before processing begins. Leadhunter imposes equivalent relevant obligations on them and remains responsible to the extent required by the GDPR.

Proposed additions and replacements are notified through a designated electronic channel, allowing objections on specific privacy or security grounds within a stated reasonable period. This information may be supplied separately with the assignment.

Processing outside the EEA is permitted only with an applicable transfer mechanism and supplementary measures where necessary. General acceptance does not replace those safeguards. The client receives information on relevant locations and transfer safeguards. No additional consent is required for each technical transfer within the agreed processing, subject to legal requirements.

New AI, content, communication or analytics integrations receiving client data are not represented as already active. The actual provider, data flow, instruction and terms are established first.

7 · Rights, objections and contact restrictions

Requests received directly concerning client data are referred to the client without undue delay. Leadhunter supports handling and does not independently provide a substantive response except on instructions or where legally required.

An objection to direct marketing or withdrawal of consent is implemented. A minimal suppression list may be necessary to prevent further contact; its data is not used for other purposes.

Reasonable ordinary assistance forms part of the cooperation. Exceptional manual assistance may be charged at a reasonable fee agreed in advance, except where needed because of Leadhunter’s breach.

8 · Personal data breaches and assistance

Leadhunter reports a personal data breach involving data processed for the client without undue delay after becoming aware of it. As available, the report includes its nature, affected data, likely consequences, measures and contact point; information may be supplied in stages.

Leadhunter investigates and limits the incident and assists the client with statutory notifications. The client determines notifications to individuals and the supervisory authority. A notification is not an admission of liability.

Leadhunter provides reasonably available information and assistance for data protection impact assessments, prior consultation and statutory inquiries insofar as relevant to its processing.

9 · Verification and audit

Leadhunter makes information available to demonstrate compliance and cooperates with audits and inspections required by GDPR Article 28. Existing relevant reports are used where possible.

Audits protect other clients’ data and trade secrets, take place during business hours on reasonable notice and minimise disruption. These practical conditions must not make statutory rights impossible in practice.

Additional reasonable audit costs are agreed in advance. Where an audit identifies a material breach by Leadhunter, directly related reasonable costs are borne by Leadhunter.

10 · Retention, return and deletion

The assignment records which data is retained for which purpose. The client may receive relevant client data through available functions or an agreed export.

After processing services end, the client chooses return or deletion unless retention is required by law. Without other instructions, completion, export and deletion are coordinated and carried out within thirty days after the end where technically reasonable.

Technical backup copies remain protected only until regular overwrite under retention established before processing. Deletion instructions are reapplied after recovery. Leadhunter’s own statutory administration is outside the assignment and is not silently retained as an active client list.

An active suppression record may retain minimal data insofar as necessary to prevent contact. Its role, legal basis and retention are recorded.

11 · Liability, duration and changes

The general terms’ liability provisions apply to the extent legally permitted. They do not limit individuals’ mandatory rights or supervisory authorities’ powers.

Each party remains responsible for its own obligations. This agreement ends when processing and required deletion or return have been completed. Dutch law and the competent court in the main agreement apply without affecting GDPR powers.

Annex 1 · Description of processing

Subject and purpose: delivery of agreed commercial support on the client’s behalf, including target market preparation, customer contact, handover, planning and follow-up.

Nature: collecting within instructions, consulting, organising, recording, updating, communicating, reporting back, exporting and deleting. Frequency: during the agreed work.

Individuals: business contacts at prospects, current and former customers, the client’s employees and others necessarily involved in communications.

Data: name, role, employer, business contact details, relevant public business information, conversation history, notes, assignment-related interests, appointments, follow-up requests and contact preferences or objections.

Not included as standard: special-category or criminal-offence data, full conversation recordings, automated individual decisions with significant effects and processing outside the agreed purpose. Recording or transcription requires separate prior documentation of purpose, information, legal basis, recipients and retention.

Duration and locations: according to the assignment and advance information on subprocessors. Actual hosting, telecommunications, email, independent personnel and backup retention must be confirmed before use.

Annex 2 · Security principles

Personal accounts, appropriate authentication, task-based access management and timely withdrawal of access

Logical separation between clients, controlled access to exports and secure transfer

Encrypted transport and appropriate protection of stored data and secrets

Limited logging without passwords or unnecessary conversation content, with agreed retention

Appropriate backups, recovery procedures, maintenance, incident response and security review

Confidentiality, work instructions and contractual assessment of independent subprocessors

These are proposed contractual principles, not a certification claim. They are checked against the actual Leadhunter systems before adoption.