Data processing agreement
Data processing agreement
Version 1.1 of 21 October 2026. It describes how we handle the data of your clients in your own Avsaro. You accept it with your order.
In short
- You are the controller for the data in your own Avsaro. We are the processor: we host, secure and maintain the installation and do what you instruct us to do.
- We only use the data to provide Avsaro. We have no purposes of our own, no marketing, no demo or testing with your data, and your data does not go into third-party tools.
- Security: an installation of your own with its own database and keys, mandatory two-step verification and a backup every night.
- Strato (server in Berlin) and Microsoft (a copy of the backup and our own email) help us. We announce a new party 14 days in advance and you may object.
- We report a data breach to you within 48 hours of establishing it. You decide whether to report it to the Dutch Data Protection Authority.
- At the end you can export your data, or have us export it, within 10 working days. We keep your data for up to 12 months after the end date and then delete it by hand, backups included, after announcing it at least 14 days in advance. On your request we delete it sooner, within 30 days.
- You may audit us once a year and after a data breach.
- You make sure there is a legal basis, inform your own clients, keep special categories of data out of Avsaro, keep your login details safe and report a data breach right away.
The Dutch text is binding
This summary is a convenience and is not the agreement. The agreement is in Dutch and the Dutch text is binding (article 16.3 of the agreement). If this summary and the Dutch text differ, the Dutch text applies.