Data Processing Agreement

GDPR-compliant data processing terms for AmiSyn B.V. and its divisions

Last updated: January 15, 2025

Download PDF Version

Get the complete DPA as a signed PDF document

Introduction

This Data Processing Agreement ("DPA") forms part of the agreement between AmiSyn B.V. (and its divisions: Amisec, Amiphished, and AmiCloud) and the Customer for the provision of services. This DPA reflects the parties' agreement with regard to the Processing of Personal Data in accordance with the requirements of the General Data Protection Regulation (GDPR).

1. Definitions

"Personal Data"

means any information relating to an identified or identifiable natural person.

"Processing"

means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, erasure or destruction.

"Controller"

means the Customer who determines the purposes and means of the Processing of Personal Data.

"Processor"

means AmiSyn B.V. (including its divisions) which Processes Personal Data on behalf of the Controller.

2. Scope and Responsibilities

2.1 Subject Matter and Duration

This DPA applies to all Processing of Personal Data by AmiSyn B.V. on behalf of the Customer in connection with the services provided. The duration of the Processing is determined by the term of the service agreement.

2.2 Nature and Purpose of Processing

The nature and purpose of the Processing depends on the services provided:

Amisec: Security assessments, penetration testing, MDR services
Amiphished: Security awareness training, phishing simulations
AmiCloud: Cloud infrastructure, AI solutions, automation services

2.3 Types of Personal Data

Depending on the services, Personal Data may include:

Contact information (names, email addresses, phone numbers)
Employment information (job titles, department)
Technical data (IP addresses, log files, system information)
Training completion data and assessment results

2.4 Categories of Data Subjects

The Customer's employees, contractors, and authorized users of the services.

3. Processor Obligations

AmiSyn B.V. shall:

Process Personal Data only on documented instructions from the Controller
Ensure that persons authorized to process Personal Data have committed to confidentiality
Implement appropriate technical and organizational measures (see Section 4)
Only engage sub-processors with prior written authorization from the Controller
Assist the Controller in responding to data subject requests
Assist the Controller in ensuring compliance with GDPR obligations
Delete or return all Personal Data upon termination of services
Make available all information necessary to demonstrate compliance

4. Technical and Organizational Measures

Security Measures

Encryption: Data in transit (TLS 1.3) and at rest (AES-256)
Access Control: Role-based access, multi-factor authentication
Monitoring: 24/7 security monitoring and logging
Infrastructure: EU-based data centers with ISO 27001 certification
Backups: Regular encrypted backups with secure storage
Incident Response: Documented breach notification procedures

5. Sub-processors

AmiSyn B.V. may engage the following sub-processors:

Sub-processor	Purpose	Location
Hostinger UAB	Infrastructure hosting	EU (Netherlands)
Cloudflare Inc.	CDN & Security	EU (Standard Contractual Clauses)

The Controller will be notified of any changes to sub-processors with 30 days' notice and may object to the appointment of new sub-processors.

6. Personal Data Breach

In the event of a Personal Data breach, AmiSyn B.V. shall:

Notify the Controller without undue delay (within 72 hours of becoming aware)
Provide all relevant information about the breach
Take reasonable measures to mitigate potential adverse effects
Cooperate with the Controller in investigating and resolving the breach

7. Contact Information

AmiSyn B.V.

Address: [Complete Address], Utrecht, Netherlands

Email: dpo@amisyn.com

Chamber of Commerce: [KvK Number]

VAT: [VAT Number]

Agreement Execution

This Data Processing Agreement is executed electronically upon acceptance of the service agreement.

Controller

(To be completed by Customer)

Processor