Legal
Data processing agreement
Last updated: 1 October 2026
Draft — have this reviewed by a lawyer.
This data processing agreement forms part of the agreement between the customer (Controller) and TB-cast, located at Maaskantveld 8, 2992HM Barendrecht, registered with the Dutch Chamber of Commerce under number 94331154 (VAT number NL005084044B32) (Processor) concerning the use of TB-cast. By accepting the terms and conditions, the customer also accepts this data processing agreement.
1. Subject and duration
- Processor processes personal data only on behalf of Controller and only as needed to provide the TB-cast service.
- This agreement applies for as long as the main agreement is in force, and thereafter for as long as Processor still processes personal data of Controller.
2. Nature, purpose and categories
| Item | Description |
|---|---|
| Purpose | Storing, managing and playing content on screens; managing users |
| Data subjects | Employees and users of the customer; persons appearing in the customer's content |
| Categories of data | Name, email address, role, login details, IP addresses, audit log; personal data the customer includes in content (such as names or photos) |
| Special categories | Not intended. The customer does not include special categories of personal data in content unless agreed otherwise in writing |
3. Obligations of Processor
- Processor processes personal data only on documented instructions from Controller, unless required otherwise by law.
- Processor ensures that persons with access to the data are bound by confidentiality.
- Processor assists Controller with data subject requests and data protection impact assessments (DPIA), where reasonable.
4. Security
Processor takes appropriate technical and organisational measures, including:
- encrypted connections (TLS) and hashed passwords;
- logical separation of data per customer;
- two-factor authentication and role-based access;
- logging of administrative actions;
- regular, encrypted backups within the EU;
- timely installation of security updates.
5. Sub-processors
- Controller gives general authorisation for engaging sub-processors for hosting, storage, email and payment processing.
- Processor informs Controller at least 30 days in advance of a new sub-processor. Controller may object on reasonable grounds.
- Processor imposes at least the same obligations on sub-processors as set out in this agreement.
6. Transfers outside the EEA
Personal data is stored within the European Economic Area. Transfers outside the EEA only take place with appropriate safeguards, such as the European Commission's standard contractual clauses.
7. Personal data breaches
- Processor notifies Controller of a personal data breach without undue delay and no later than 36 hours after discovery.
- The notification includes at least the nature of the breach, the categories of data involved, the likely consequences and the measures taken.
- Controller decides whether to notify the Dutch Data Protection Authority and data subjects.
8. Audit
Controller may have compliance with this agreement verified by an independent expert once a year, with at least 30 days' notice. Costs are borne by Controller unless a material shortcoming is found.
9. End of the agreement
After the main agreement ends, Controller can download the content for 30 days. Processor then deletes the personal data within 90 days, including copies, unless a legal retention obligation applies. Backups are overwritten within 35 days.
10. Liability
The limitation of liability in the terms and conditions applies to Processor.
11. Contact
Questions about this agreement or need a signed copy? Email info@tb-cast.nl.