General Terms and Conditions

Version 2.0 · Last updated: 1 October 2026

These are the general terms and conditions of DoQcheck B.V. They apply to the DoQcheck platform and our related services, and to the use of our website. They are written for business customers.

In short

• Your data remains yours. You keep all rights to the documents and data you put into DoQcheck. We use them only to provide our services to you, and we treat them as your confidential information (article 5).
• Your data stays in Europe. Customer Data is stored and processed exclusively in the EU/EEA, including all AI processing, and is never used to train AI models (article 5).
• Security is contractual. We maintain an ISO/IEC 27001:2022 certified security programme and notify you of security incidents affecting your data within 48 hours (article 7).
• Data processing terms are included. Annex 1 contains our data processing agreement under Article 28 GDPR.
• You can always leave with your data. At the end of the agreement, you receive a full export and we then delete your data (article 14).
• A signed agreement prevails. If we have signed an agreement with you, its terms take precedence over these general terms (article 2).

1. Definitions

In these terms, the following capitalised terms have the meanings given below:

• Agreement: the agreement between DoQcheck and the Customer for the Services, consisting of the Order, these terms and Annex 1, and any other documents the parties have agreed in writing.
• AI Output: summaries, answers, suggestions, labels and other results that the Platform generates from Customer Data.
• Authorised Users: the Customer's employees and other persons that the Customer authorises to use the Platform under its account.
• Business Day: Monday to Friday, excluding public holidays in the Netherlands.
• Confidential Information: all non-public information that a party discloses to the other in connection with the Agreement and that is marked as confidential or should reasonably be understood to be confidential. Customer Data is always the Customer's Confidential Information.
• Customer: the business or organisation that enters into an Agreement with DoQcheck.
• Customer Data: all documents, files, data, records and other content that the Customer or its Authorised Users upload to, connect to or synchronise with the Platform, including questions asked of the Platform and the AI Output generated from them.
• DoQcheck, we, us: DoQcheck B.V., Edendreef 13, 6716 HE Ede, the Netherlands, registered with the Chamber of Commerce under number 98111973.
• Order: the quotation, order form or signed agreement that describes the Services, scope, usage limits, fees and term agreed with the Customer.
• Platform: the cloud-based DoQcheck software platform.
• Services: access to the Platform and the related setup, configuration, integration, support, training and consultancy services described in the Order.
• Website: doqcheck.com and its sub-pages.

2. Applicability and order of precedence

2.1. These terms apply to all offers, Orders and Agreements of DoQcheck relating to the Services. Article 22 also applies to anyone who uses the Website.

2.2. Our Services are intended exclusively for businesses and organisations, not for consumers.

2.3. The Customer's general terms, including general purchasing conditions, do not apply, unless DoQcheck has expressly accepted them in writing. A purchase order, supplier portal registration or similar administrative document does not change the Agreement.

2.4. If documents that form part of the Agreement conflict, the following order of precedence applies:

• a) amendments signed by both parties, insofar as they expressly change a provision;
• b) the Order or individually signed agreement;
• c) Annex 1 (Data Processing Terms), for matters concerning personal data;
• d) these general terms.

2.5. Deviations from these terms are only valid if agreed in writing.

3. Offers and formation of the Agreement

3.1. Our offers are valid for 30 days, unless stated otherwise in the offer.

3.2. The Agreement is formed when both parties sign the Order, or when DoQcheck confirms the Customer's acceptance of an offer in writing.

4. The Services

4.1. Right of use. For the term of the Agreement, DoQcheck grants the Customer a non-exclusive, non-transferable right to use the Platform for its internal business purposes, within the usage limits (such as the number of users and queries) stated in the Order.

4.2. Setup and integration. DoQcheck carries out the setup, configuration and system integration described in the Order. Project dates are indicative, unless they are expressly agreed as firm deadlines. They are extended to the extent that a delay is caused by the Customer, by its systems or suppliers, by an agreed change, or by force majeure.

4.3. Updates. DoQcheck maintains, updates and improves the Platform as part of the subscription. Updates will not materially reduce the functionality agreed in the Order. Security patches and updates required by law are mandatory and may be applied at any time.

4.4. Maintenance. Planned maintenance is carried out outside office hours where reasonably possible and announced at least 48 hours in advance. Urgent maintenance needed for security or continuity may be carried out at shorter notice.

4.5. Availability and support. Availability targets, incident priorities and response times are set out in the Order or the agreed service level agreement. Unless agreed otherwise, support is available on Business Days from 09:00 to 17:00 CET/CEST via info@doqcheck.com.

4.6. Usage limits. If the Customer structurally exceeds the agreed usage limits, the parties will agree on a suitable extension. Exceeding a limit never leads to additional charges without the Customer's prior written agreement.

4.7. Pilot and beta features. Features that are clearly marked as pilot, beta or preview are provided as-is and are excluded from availability commitments. Article 5 (Customer Data), article 7 (Security) and Annex 1 apply to them in full.

4.8. Additional work. Additional integrations, custom features, on-site work and other work outside the agreed scope are performed only after a written quotation has been accepted.

5. Customer Data

5.1. Ownership. The Customer retains all rights, title and interest in the Customer Data. DoQcheck acquires no rights to Customer Data other than the limited right in article 5.2.

5.2. Limited use. The Customer grants DoQcheck, for the term of the Agreement, a non-exclusive right to host, copy, synchronise, index, analyse, process and display Customer Data, solely to the extent necessary to provide, secure, maintain and support the Services for the Customer.

5.3. Confidential by default. Customer Data is the Customer's Confidential Information and is protected as such under article 10. The Platform is designed to handle confidential documents, trade secrets and other sensitive business information. DoQcheck does not sell Customer Data, does not disclose it to third parties other than the sub-processors in article 9, and never makes it available to other customers.

5.4. No AI training. Neither DoQcheck nor its sub-processors use Customer Data or AI Output to train or improve general AI models, or models or services for other customers. DoQcheck ensures that its cloud and AI providers are contractually prohibited from doing so. DoQcheck may tune search, prompt suggestions and recommendations specifically for the Customer; such improvements are used only for that Customer.

5.5. Anonymised statistics. DoQcheck may create and use aggregated, anonymised statistics about the use of the Services (such as performance metrics and feature usage) solely to maintain and improve the Services. Such statistics do not contain the contents of Customer Data and do not allow the identification of the Customer or any person, or the reconstruction of Customer Data. DoQcheck will not attempt to re-identify the Customer or any person from them.

5.6. EU/EEA only. DoQcheck stores and processes Customer Data exclusively in data centres within the European Union / European Economic Area, and does not transfer Customer Data, or allow it to be transferred, outside the EEA. This includes AI processing. The current hosting locations are listed in our Privacy Policy. If EU or Member State law requires DoQcheck to disclose Customer Data, DoQcheck will inform the Customer in advance, unless that law prohibits it, and will disclose no more than is legally required.

5.7. Embeddings and indexes. Search indexes, embeddings and similar derived data generated from Customer Data are treated in the same way as Customer Data for the purposes of confidentiality, security, location and deletion.

5.8. Customer's responsibilities. The Customer ensures that it is entitled to provide the Customer Data to DoQcheck for use with the Services, including, where personal data is concerned, that it has a legal basis for doing so. The Customer remains responsible for the accuracy and completeness of the Customer Data.

5.9. Integrations. When the Platform is connected to the Customer's systems (such as a document management system), DoQcheck uses the least access needed (read-only where possible) and the Customer determines which sources are connected.

6. AI Output

6.1. Ownership. As between the parties, any intellectual property rights in AI Output generated specifically for the Customer belong to the Customer, insofar as they are transferable. To the extent such rights vest in DoQcheck, DoQcheck hereby assigns them to the Customer, which accepts the assignment. The Customer may use, copy, modify and distribute AI Output for its business purposes.

6.2. Review before use. DoQcheck takes reasonable technical and organisational measures to support the reliability and traceability of AI Output. However, AI Output can contain errors or omissions. It supports, and does not replace, professional judgement. The Customer reviews AI Output, the underlying Customer Data and the applicable requirements before using AI Output for material operational, quality, food safety, legal or regulatory decisions, and remains responsible for those decisions.

6.3. Similar output. AI Output does not need to be unique. Similar generic output may be generated for other customers, but never on the basis of the Customer's Customer Data or Confidential Information.

6.4. AI regulation. Each party complies with the obligations that apply to its role under applicable AI legislation, including the EU Artificial Intelligence Act, and gives the other party reasonable assistance to do so.

7. Security

7.1. Measures. DoQcheck takes and maintains appropriate technical and organisational measures, in line with good industry practice, to protect the Platform and Customer Data against unauthorised or unlawful access, loss, alteration or disclosure. These include:

• a) logical isolation of each customer's environment and data;
• b) encryption of Customer Data in transit and at rest;
• c) private networking, with no public internet access to databases, file storage, key vaults and AI services, and a web application firewall;
• d) role-based access control, mandatory multi-factor authentication by default, and least-privilege administrative access;
• e) logging, monitoring and a tamper-evident audit trail;
• f) backup and recovery;
• g) vulnerability and patch management, secure development practices and independent penetration testing;
• h) incident response procedures and periodic review of the effectiveness of these measures.

A more detailed description is available in our Privacy Policy and on request.

7.2. ISO/IEC 27001. DoQcheck maintains an information security management system certified under ISO/IEC 27001:2022. On reasonable written request, at most once per calendar year, DoQcheck provides the Customer with its current certificate and a reasonable summary of its security measures, the most recent available audit report or a completed security questionnaire.

7.3. Security incidents. If DoQcheck becomes aware of a confirmed security incident that materially affects the confidentiality, integrity or availability of Customer Data, DoQcheck notifies the Customer without undue delay and in any case within 48 hours. DoQcheck provides the available information about the nature and expected impact of the incident and the measures taken or proposed, and keeps the Customer informed as the investigation progresses. An initial notification is not an admission of fault or liability.

7.4. Customer's security. The Customer keeps login credentials confidential, manages the access rights of its Authorised Users, and informs DoQcheck without delay of any suspected unauthorised use of its accounts. The Customer is responsible for use of the Platform through its accounts.

7.5. Security testing. The Customer may not carry out security or load tests on the Platform without DoQcheck's prior written consent. DoQcheck will not unreasonably refuse a request for coordinated testing.

8. Data protection

8.1. With respect to personal data in Customer Data, the Customer is the controller (or a processor on behalf of a third-party controller) and DoQcheck is the processor. The Data Processing Terms in Annex 1 apply and form the data processing agreement between the parties under Article 28 of the GDPR. On request, DoQcheck will sign a separate copy.

8.2. Where DoQcheck processes personal data as a controller, such as business contact details, our Privacy Policy applies.

9. Sub-processors

9.1. The Customer gives DoQcheck general authorisation to engage sub-processors, including cloud infrastructure and AI service providers, for the provision of the Services. The current list of sub-processors that may process Customer Data, with their locations, is published in our Privacy Policy.

9.2. DoQcheck imposes data protection obligations on each sub-processor that are substantially equivalent to those in these terms, including the EU/EEA location requirement of article 5.6 and the training prohibition of article 5.4. DoQcheck remains responsible for its sub-processors' performance.

9.3. DoQcheck notifies the Customer at least 30 days before adding or replacing a sub-processor that processes Customer Data. The Customer may object on reasonable data protection grounds within that period. The parties will then discuss the objection in good faith. If they cannot resolve it, the Customer may terminate the affected Services with effect from the change, and DoQcheck refunds any prepaid fees for the period after termination on a pro rata basis.

10. Confidentiality

10.1. Each party keeps the other party's Confidential Information confidential, protects it with at least the care it applies to its own confidential information (and no less than reasonable care), and uses it only to perform the Agreement.

10.2. A party may disclose Confidential Information only to its employees, advisers and subcontractors who need it to perform the Agreement and who are bound by confidentiality obligations at least as strict as these. Disclosure required by law or by a competent authority is permitted, after prior notice to the other party where legally possible, and only to the extent required.

10.3. These obligations do not apply to information that is or becomes public through no fault of the receiving party, that the receiving party already lawfully had, that it lawfully receives from a third party without a duty of confidentiality, or that it develops independently.

10.4. These obligations remain in force for three years after the end of the Agreement. For trade secrets and Customer Data, they remain in force for as long as the information remains confidential or, for Customer Data, until it has been deleted in accordance with article 14.

11. Intellectual property

11.1. All intellectual property rights in the Platform, the software and source code, DoQcheck's documentation, models, algorithms, system prompts, templates, configurations, methods, know-how, updates and underlying technology remain with DoQcheck or its licensors. No payment or delivery transfers them to the Customer. This does not affect the Customer's rights in Customer Data and AI Output, or article 5.7.

11.2. Feedback. If the Customer gives suggestions or feedback about the Services, DoQcheck may use that feedback freely to improve its Services. Feedback never includes Customer Data or the Customer's Confidential Information, which remain protected under articles 5 and 10.

11.3. IP indemnity. DoQcheck will defend the Customer against any third-party claim that the Customer's authorised use of the Platform infringes that third party's intellectual property rights, and will indemnify the Customer for damages and reasonable legal costs finally awarded by a competent court or agreed in a settlement approved by DoQcheck. This applies provided that the Customer notifies DoQcheck of the claim promptly, leaves the conduct of the defence and any settlement to DoQcheck, and gives reasonable cooperation. DoQcheck will not settle a claim in a way that admits liability on behalf of the Customer or imposes non-monetary obligations on it without the Customer's consent. This indemnity does not apply to claims arising from Customer Data, from changes made by or for the Customer, from unauthorised use, or from combinations with products or services not supplied or approved by DoQcheck.

11.4. If such a claim is made or is likely, DoQcheck may obtain the necessary rights, modify or replace the affected functionality with a reasonably equivalent alternative, or, if neither is reasonably possible, terminate the affected Services and refund the prepaid fees for the period after termination on a pro rata basis.

11.5. References. DoQcheck does not use the Customer's name or logo or publish any information about the Customer without the Customer's prior written consent.

12. Acceptable use

12.1. The Customer and its Authorised Users will not:

• a) sell, rent, sublicense or otherwise make the Platform available to third parties, or use it to provide a competing service;
• b) circumvent security measures or usage limits;
• c) reverse engineer, decompile or disassemble the Platform, except to the extent permitted by mandatory law;
• d) upload malware or content that is unlawful, or process personal data without a legal basis;
• e) remove copyright, trademark or other proprietary notices.

12.2. Suspension. DoQcheck may suspend access to the Platform to the extent strictly necessary if use of the Platform poses a serious security threat or is clearly unlawful. DoQcheck notifies the Customer in advance where possible, limits the suspension to what is necessary, and restores access as soon as the cause has been removed.

13. Fees and payment

13.1. The fees are set out in the Order. All amounts are in euros and exclusive of VAT.

13.2. Unless agreed otherwise, one-off fees are invoiced when the Agreement is formed, and subscription fees are invoiced in advance at the frequency agreed in the Order, starting on the date DoQcheck confirms that the Platform is available for operational use.

13.3. Invoices are payable within 30 days of the invoice date.

13.4. If the Customer pays late, it owes the statutory commercial interest (article 6:119a of the Dutch Civil Code) from the due date, plus reasonable extrajudicial collection costs.

13.5. If an undisputed invoice remains unpaid 14 days after a written reminder, DoQcheck may suspend access to the Platform until payment is received. Suspension does not affect the security, confidentiality or retention of Customer Data.

13.6. Subscription fees are fixed for the initial term. DoQcheck may adjust them at the start of a renewal period, provided it notifies the Customer in writing before the deadline for giving notice of non-renewal. Without such notice, the fee for the renewal period increases by no more than the annual change in the Dutch consumer price index (CPI, all households) published by Statistics Netherlands (CBS), and does not decrease if the index is negative.

13.7. Additional work and additional costs are invoiced only after the Customer's prior written approval.

14. Term, termination and exit

14.1. Term. The Agreement is entered into for the initial term stated in the Order, or, if none is stated, for 12 months from the date the Platform is made available for operational use. After that, it renews automatically for successive periods of 12 months, unless either party gives written notice of non-renewal at least 3 months before the end of the current period.

14.2. No early termination for convenience. Neither party may terminate the Agreement for convenience during the initial term, without prejudice to articles 9.3, 11.4 and 14.3.

14.3. Termination for cause. Either party may terminate the Agreement in whole or in part by written notice if:

• a) the other party fails to remedy a material breach within 30 days of a written notice of default; if the breach can be remedied but not reasonably within 30 days, this right does not arise as long as the defaulting party starts the remedy within that period and completes it promptly;
• b) the Customer fails to pay an undisputed invoice within 14 days of a written reminder;
• c) the other party is declared bankrupt, is granted a suspension of payments, is dissolved or ceases its business, to the extent permitted by law;
• d) force majeure continues for more than 60 days.

14.4. Data export. Up to 90 days after the end of the Agreement, the Customer may request a full standard export of its Customer Data. The export consists of the documents uploaded by the Customer in their original file formats, plus the structured records created by the Customer, relevant metadata and audit or status information in CSV, JSON or another common machine-readable format, to the extent technically available. DoQcheck delivers the export within 10 Business Days of a valid written request. One export after termination is included at no extra cost. Custom transformations, migration to third-party systems and other exit support are provided on the basis of an agreed quotation.

14.5. Deletion. DoQcheck keeps the Customer Data securely for 90 days after the end of the Agreement, solely for export, migration, security and legal compliance, unless the Customer instructs earlier deletion or the law requires longer retention. It then deletes the Customer Data from its active systems (after delivering an export requested within that period). Backup copies are deleted or overwritten in DoQcheck's regular backup cycle, which takes at most 12 months, and remain protected and unavailable for regular use until then. On request, DoQcheck confirms the deletion in writing.

14.6. Provisions that by their nature are intended to survive the end of the Agreement remain in force, including articles 5, 10, 11, 14.4–14.5, 16 and 21.

15. Performance and warranty

15.1. DoQcheck performs the Services with skill and care, and the Platform provides the functionality, scope and service levels expressly agreed in the Order. Minor deviations that do not materially affect normal use do not constitute a breach.

15.2. If the Platform materially fails to provide the agreed functionality, the Customer notifies DoQcheck in writing with sufficient detail. DoQcheck handles the deviation according to the agreed service levels and uses reasonable efforts to remedy it within 30 days, or, if more time is reasonably needed, shares a remedy plan and timeline and carries it out promptly. If DoQcheck does not do so, the Customer may terminate the affected Services and receive a pro rata refund of prepaid fees for the period after termination.

15.3. DoQcheck takes reasonable measures to ensure continuity and availability, but does not guarantee that the Platform will operate entirely without interruption or errors. Availability can also be affected by the public internet, the Customer's systems and third-party integrations outside DoQcheck's reasonable control.

15.4. DoQcheck is not responsible for failures to the extent caused by incorrect use, incorrect or incomplete Customer Data, the Customer's systems, unauthorised changes, or third-party services outside DoQcheck's reasonable control.

16. Liability

16.1. The total liability of each party for direct damage arising from or in connection with the Agreement is limited to the subscription fees paid or payable by the Customer for the six (6) months preceding the event that gave rise to the liability.

16.2. For direct damage arising from a breach of article 10 (Confidentiality) or Annex 1 (Data Processing Terms), from loss of Customer Data or a security incident attributable to DoQcheck, or from the indemnity in article 11.3, DoQcheck's total liability is limited to twice the amount in article 16.1.

16.3. Neither party is liable for indirect or consequential damage, including lost profits, lost savings, production loss, loss of goodwill, reputational damage and missed business opportunities.

16.4. The limitations in this article do not apply in the event of intent or deliberate recklessness of a party's management, to damage resulting from death or bodily injury, or insofar as a limitation is not permitted by mandatory law.

16.5. DoQcheck is not liable to the extent that damage results from incorrect, incomplete or outdated Customer Data, from the Customer's failure to meet its obligations under articles 6.2, 7.4 or 12, from the Customer's systems or credentials, from third-party services outside DoQcheck's reasonable control, or from use of the Platform outside its intended purpose. This does not limit DoQcheck's liability to the extent that a failure by DoQcheck caused or contributed to the damage.

16.6. The same damage cannot be compensated more than once. All penalties, service credits, indemnities and other financial remedies under the Agreement are subject to this article 16.

17. Force majeure

17.1. Neither party is liable for delay or failure to perform caused by circumstances beyond its reasonable control. The affected party informs the other party as soon as possible and takes reasonable steps to limit the consequences.

17.2. If force majeure continues for more than 60 days, either party may terminate the Agreement in accordance with article 14.3.

18. Insurance

DoQcheck maintains professional liability, general liability and cyber insurance with reputable insurers, appropriate to the nature and scope of the Services. On written request, DoQcheck provides proof of insurance. Insurance does not extend DoQcheck's liability under article 16.

19. Changes to these terms

19.1. DoQcheck may amend these terms. We publish amendments on the Website at least 30 days before they take effect and notify existing Customers by email.

19.2. For existing Agreements, amendments take effect only from the next renewal period, unless they are required by law or do not adversely affect the Customer. Amendments never reduce the protection of Customer Data in articles 5, 7, 9 and 10 and Annex 1 during the term of an existing Agreement without the Customer's written consent.

20. Miscellaneous

20.1. Assignment. The Customer may not transfer its rights or obligations under the Agreement without DoQcheck's prior written consent, which will not be unreasonably withheld or delayed. DoQcheck may transfer the Agreement to a group company or a successor in the event of a merger, reorganisation or sale of all or substantially all of its business, provided that continuity of the Services and these data protection commitments are maintained. The Customer hereby cooperates in advance with such a transfer within the meaning of article 6:159 of the Dutch Civil Code.

20.2. Subcontracting. DoQcheck may engage subcontractors and remains responsible for the obligations it subcontracts. Article 9 applies to sub-processors.

20.3. Notices. "In writing" includes email. Notices of non-renewal or termination must be sent to the other party's designated contract contact and take effect upon confirmed receipt.

20.4. Severability. If a provision is void or unenforceable, the remaining provisions remain in full force, and the parties replace the provision with a valid one that comes as close as possible to its purpose.

20.5. Entire agreement. The Agreement replaces all prior oral and written arrangements on the same subject.

20.6. Language. These terms are drawn up in English. If they are translated, the English version prevails.

21. Governing law and disputes

21.1. The Agreement is governed exclusively by Dutch law. The United Nations Convention on Contracts for the International Sale of Goods (CISG) does not apply.

21.2. The parties will first try to resolve a dispute through consultation at management level for 30 days. They may then, by mutual agreement, use ICT mediation.

21.3. Disputes that are not resolved amicably are submitted exclusively to the competent court of the District Court of Gelderland (Rechtbank Gelderland), the Netherlands.

22. Use of our website

22.1. The information on the Website is general and is provided for information purposes only. We may change it at any time. No rights can be derived from it.

22.2. All intellectual property rights in the Website and its content (text, images, videos, designs and logos) belong to DoQcheck or its licensors. You may view and print the content for your own information. You may not copy, republish or systematically retrieve it (for example by scraping) without our prior written consent, or interfere with the operation of the Website.

22.3. The Website may contain links to third-party websites. We are not responsible for their content or privacy practices.

22.4. The contact and booking forms on the Website are meant for initial enquiries. Please share confidential documents only through the DoQcheck platform or another channel agreed with us. How we handle personal data that you send us is described in our Privacy Policy.

22.5. The Website is provided as-is. To the extent permitted by law, DoQcheck is not liable for damage resulting from the use of the Website, except in the event of intent or deliberate recklessness.

23. Contact

DoQcheck B.V. Edendreef 13, 6716 HE Ede, the Netherlands Chamber of Commerce (KvK): 98111973 info@doqcheck.com

Annex 1: Data Processing Terms

These Data Processing Terms form part of the Agreement and apply insofar as DoQcheck processes personal data on behalf of the Customer in connection with the Services. Terms defined in the General Terms and Conditions have the same meaning here; "GDPR" means Regulation (EU) 2016/679. With respect to matters concerning personal data, these Data Processing Terms prevail over the rest of the Agreement.

1. Roles and instructions

1.1. The Customer is the controller (or a processor on behalf of a third-party controller) and DoQcheck is the processor of personal data in Customer Data.

1.2. DoQcheck processes personal data only on the Customer's documented instructions, including those in the Agreement, and only to the extent necessary to provide, secure, maintain and support the Services. DoQcheck informs the Customer immediately if, in its opinion, an instruction infringes the GDPR.

1.3. If EU or Member State law requires DoQcheck to process personal data beyond the Customer's instructions, DoQcheck informs the Customer before processing, unless that law prohibits such notice on important grounds of public interest.

2. Confidentiality and security

2.1. DoQcheck ensures that persons authorised to process the personal data are bound by an appropriate duty of confidentiality.

2.2. DoQcheck takes and maintains the technical and organisational measures required by Article 32 GDPR, as described in article 7 of the General Terms and Conditions, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.

3. Sub-processors

3.1. The Customer gives DoQcheck general written authorisation to engage sub-processors in accordance with article 9 of the General Terms and Conditions, including the 30-day advance notice of changes and the Customer's right to object.

3.2. DoQcheck imposes on each sub-processor, by written contract, data protection obligations substantially equivalent to these Data Processing Terms, and remains fully responsible to the Customer for each sub-processor's performance.

4. Location and international transfers

4.1. DoQcheck processes personal data exclusively within the European Union / European Economic Area and does not transfer it, or allow it to be transferred, to a country outside the EEA.

4.2. If, in an exceptional case, a transfer outside the EEA becomes necessary, DoQcheck will only make it with the Customer's prior written consent and on the basis of a transfer mechanism under Chapter V of the GDPR.

5. Assistance

5.1. Taking into account the nature of the processing, DoQcheck assists the Customer through appropriate technical and organisational measures, where possible, in responding to requests from data subjects exercising their rights. DoQcheck forwards any such request it receives directly to the Customer without undue delay and does not respond to it itself, unless the Customer instructs it to.

5.2. DoQcheck gives the Customer reasonable assistance in complying with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation). DoQcheck may charge reasonable costs for assistance that goes beyond its regular support.

6. Personal data breaches

6.1. DoQcheck notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting personal data processed on behalf of the Customer.

6.2. The notification includes, as far as available, the information referred to in Article 33(3) GDPR: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information that is not yet available is provided as soon as it becomes available.

6.3. DoQcheck takes the reasonable measures needed to contain the breach and limit its consequences, and documents the breach.

7. Return and deletion

At the end of the Services, DoQcheck returns or deletes the personal data, at the Customer's choice, and deletes existing copies, unless EU or Member State law requires further storage. The export, retention and deletion procedure in articles 14.4 and 14.5 of the General Terms and Conditions applies.

8. Audits

8.1. DoQcheck makes available to the Customer the information reasonably necessary to demonstrate compliance with these Data Processing Terms, and allows for and contributes to audits.

8.2. Audits are carried out, where reasonably sufficient, on the basis of DoQcheck's ISO/IEC 27001 certificate, the available audit reports and security questionnaires. An on-site audit must be reasonably necessary, announced at least 30 days in advance, carried out during normal office hours by the Customer or an independent auditor bound by confidentiality, and may take place at most once per calendar year, unless a supervisory authority requires it or it is reasonably necessary following a material personal data breach. Each party bears its own costs of an audit.

9. Liability

Liability under these Data Processing Terms is subject to article 16 of the General Terms and Conditions.

10. Description of the processing