Data Processing Agreement

Parties

This data processing agreement is entered into between:

• The Controller: the party using LimeDesk's services (you, as the customer).
• The Processor: LimeDesk (KvK: 99420929).

Article 1 — Definitions

• Personal data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data, such as collecting, storing, altering, consulting or destroying.
• Data subject: the natural person to whom the personal data relates.
• Data breach: a breach of security leading to the destruction, loss, alteration or unauthorized access to personal data.

Article 2 — Subject matter and duration

This agreement relates to the processing of personal data by the Processor for the purpose of the AI assistant services. The agreement remains in effect for as long as the Processor processes personal data on behalf of the Controller.

Upon termination, all personal data will be deleted within 90 days, unless otherwise legally required.

During the term, the Processor automatically deletes conversations, messages, email drafts and technical logs once they are older than the retention period the Controller sets in the dashboard (30, 90, 180 or 365 days, or no automatic deletion; 1 year by default). Encrypted backups are deleted after 14 days.

Article 3 — Data processed

Article 4 — Obligations of the Processor

1. Process personal data solely on the basis of written instructions from the Controller.
2. Ensure that persons with access are bound by confidentiality.
3. Implement appropriate technical and organizational security measures.
4. Only engage the subprocessors listed in Article 6. A new subprocessor will be announced by email at least 30 days in advance; the Controller may object and in that case terminate the agreement free of charge.
5. Assist the Controller with requests from data subjects.
6. Delete or return all personal data upon completion.
7. Make all information available for compliance audits.

Article 5 — Security measures

• SSL/TLS encryption for all data transfer.
• Passwords stored hashed (bcrypt) and Shopify access keys encrypted (AES-256-GCM); daily backups are stored encrypted.
• Database and attachments encrypted on the server's disk (AES-256).
• Server access only for the owner of LimeDesk; dashboard access role-based and strictly separated per customer.
• Daily backups and an incident response plan for recovery.
• Access log (logins, access to conversations, exports and administrative access) and availability monitoring.
• Hosting within the European Union.

Article 6 — Subprocessors

* With appropriate safeguards based on the EU Standard Contractual Clauses (SCCs).

Article 7 — Data breaches

The Processor will notify the Controller of a data breach within 24 hours, including its nature, affected data subjects, consequences and measures taken.

Article 8 — Rights of data subjects

The Processor assists the Controller in handling GDPR requests (access, rectification, erasure, restriction, portability, objection).

Article 9 — Audit

The Controller has the right to conduct audits to verify compliance.

Article 10 — Liability

Liability is limited to the amount paid by the Controller in the 12 months preceding the event.

Article 11 — Final provisions

• Dutch law applies.
• Disputes will be submitted to the court in Amsterdam.
• Changes are only valid in writing.