Data Processing Agreement Denkploeg

1. Parties and roles

1. Processor: Het Creatieve Bureau (sole proprietorship, Chamber of Commerce number 72101121, VAT ID NL001154747B27, Loudonstraat 51, 3317 PA Dordrecht), as provider of Denkploeg, hereinafter "Denkploeg".
2. Controller: the organisation that enters into the agreement for Denkploeg with Denkploeg and uses a workspace under it, hereinafter "the Customer". If the counterparty is an agency, paragraph 3 applies. The name and details of the Customer are in the order, the quotation or the account with Denkploeg.
3. Agency. If the counterparty is an agency that processes personal data on behalf of its clients, the agency is the processor of its client and Denkploeg is the sub-processor of the agency (Article 28(4) GDPR). The agency warrants that its client has given written authorisation for Denkploeg and the sub-processors in Annex 3. This agreement imposes on Denkploeg at least the obligations from the agreement between agency and client. Instructions from the client run via the agency. If the agency drops out or is no longer authorised, the client may invoke this agreement directly.
4. This agreement forms part of the general terms and conditions and applies to every workspace. In the event of conflict, this agreement prevails as regards personal data.

2. Subject matter and purpose

Denkploeg processes personal data for the Customer solely in order to provide the platform: storing, organising, displaying, passing on to the crew and executing (after approval by a human) what the Customer does in its workspace. The nature, purpose, types of data and categories of data subjects are set out in Annex 1. The duration equals the duration of the agreement, plus the wind-down under Article 11.

3. Instructions

1. Denkploeg processes personal data only on documented instructions from the Customer. The agreement, the settings in the workspace and the actions of the Customer's users (including signing a proposal) constitute those instructions.
2. Denkploeg shall notify the Customer if, in its opinion, an instruction infringes the GDPR or other regulations.
3. Denkploeg does not process data for its own purposes, with the exception of its own processing under Article 15. Denkploeg itself does not train models on data from a workspace and does not share it with other workspaces. Suppliers that train on input or share input with partners (according to our overview currently including ElevenLabs, Higgsfield and OpenArt) are off by default for customer material and are turned on only after a recorded choice by the Customer. The same applies to suppliers for which it has not been established whether they train on input (currently including fal, Recraft, Photoroom, Vectorizer.AI and Ideogram): customer material goes there only after a recorded choice.
4. The Customer instructs Denkploeg to carry out requests that an integration platform (such as Meta) sends on behalf of a data subject, to revoke or erase the data of that data subject (access, tokens and integrations) in accordance with the terms of that platform.
5. The Customer provides a cookie and storage statement on its own website, also for what Denkploeg's Support widget places there (a visitor ID in localStorage). Denkploeg supplies the text on request.
6. If Denkploeg is legally required to carry out processing or a transfer outside the instruction, it notifies this in advance, unless the law prohibits it. A request from an authority for the Customer's data is notified by Denkploeg to the Customer and contested where reasonable.

4. Confidentiality

Persons who work with the data for Denkploeg are bound by confidentiality. Through the platform, Denkploeg staff look into a workspace only where necessary for administration or support, with a stated reason that is visible in the workspace's history (break-glass access). Administrators with access to the server itself are limited to the owner (J. Katgerman) with an SSH key; deployment and tools work under his supervision and with his key, and no third parties have access, and bound by confidentiality; that access currently leaves no trace in the history.

5. Security

Denkploeg implements the technical and organisational measures set out in Annex 2 and maintains them at an appropriate level. We review them at least annually and upon a significant change.

6. Sub-processors

1. The Customer grants Denkploeg general authorisation for the sub-processors in Annex 3.
2. Denkploeg announces a new or replacement sub-processor at least 30 days in advance, via the app and by email to the owners of the workspace. Within that period the Customer may object on reasoned grounds. If we cannot reach agreement, the Customer may terminate the agreement for the service concerned.
3. Denkploeg imposes on a sub-processor at least the same obligations as in this agreement and remains responsible towards the Customer for their performance.
4. Optional services that the Customer itself enables with its own account or its own key (an integration with Meta, Google, Shopify and the like) are not sub-processors of Denkploeg but processors or controllers of the Customer itself. Denkploeg sends data to them only on the Customer's instructions.
5. A Customer with its own key for a model supplier brings its own agreement with that supplier and is itself responsible for the transfer to that supplier. Denkploeg sends data there only on the Customer's instructions; choosing its own key is that instruction.
6. The list is also available at subprocessors.

7. Assistance with data subject rights

Denkploeg assists the Customer, by appropriate technical and organisational means, with requests from data subjects and carries out a request on the Customer's direction within 10 working days. Available: a GDPR request with a thirty-day deadline, an export of a person or relation (access and portability), erasure of a person or relation (a human signs), erasure of a support conversation, of a WhatsApp sender and of a newsletter subscriber, and anonymisation of a guest. Not everything has a screen yet; what is still manual is done on request. If Denkploeg itself receives a request from a data subject about data in a workspace, it refers that data subject to the Customer and does not handle it itself, unless the Customer asks it to.

8. Assistance under Articles 32 to 36 GDPR

Denkploeg assists the Customer with security, notifications of personal data breaches, data protection impact assessments and prior consultation, to the extent that can reasonably be expected of a processor and with the information available to Denkploeg.

9. Personal data breaches, information and audits

1. Denkploeg notifies the Customer of a personal data breach without undue delay and at the latest within 24 hours after becoming aware of it, with the information then known (nature, data and numbers concerned, likely consequences, measures taken and proposed). We report to the workspace owner and, if the Customer works through an agency, also to the agency. Point of contact: J. Katgerman, privacy@denkploeg.nl; outside office hours, in an emergency, via WhatsApp on +31 6 13816926 (also the number of our WhatsApp assistant; a message there is picked up by a human).
2. On request, Denkploeg provides the Customer with the information necessary to demonstrate compliance, including the current security measures and the audit trail of its own workspace.
3. An audit by or on behalf of the Customer may take place once a year, after 30 days' notice (and more often after a breach or at the order of a supervisory authority), subject to confidentiality, without affecting the data of other customers and with reimbursement of reasonable costs. An independent report may replace an audit.

10. Transfers outside the EEA

Denkploeg transfers data outside the EEA only with an appropriate mechanism (an adequacy decision or standard contractual clauses with supplementary measures) and on the Customer's instructions. The transfers are listed in Annex 3 and at subprocessors.

11. End, export and deletion

1. At the end of the agreement, or earlier on request, Denkploeg makes the Customer's data available as an export (the entire workspace as a file, plus separate exports per component).
2. After the end date the Customer can still read and export for thirty days; the workspace is then archived and emptied after a further ninety days (Article 12(7) of the general terms and conditions): all files, exports, the workspace's memory folder and data in that workspace's database are erased. What remains: the administration (usage, ledger, contracts and invoices, seven years, statutory tax retention obligation) and the audit trail. That trail is append-only and contains ids and types of actions; since 14 October 2026 new entries contain no email address and no full IP address (older entries sometimes still do). No statutory retention obligation has been designated for the trail. We keep the trail for 2 years and then anonymise the user ID, the email address and the IP address in the entries (Article 28(3)(g) GDPR).
3. Data in back-ups disappears when the back-up expires. The retention period of the back-ups is: daily 7, weekly 4, monthly 6, so an oldest snapshot of about seven months. Data from a restored back-up is not put back into use without the deletion being carried out again.
4. Content that the Customer no longer wishes to retain may also be erased in the interim. The periods in Annex 1 are the periods that the platform itself applies; where it says "the Customer determines", the Customer determines the period and no maximum applies.

12. Term

This agreement starts with the agreement and ends when Denkploeg has erased all of the Customer's personal data in accordance with Article 11. Obligations that by their nature continue to apply remain in force.

13. Liability

Liability under this agreement is governed by Article 13 of the general terms and conditions; the limitation there applies to all claims under the terms and this agreement together. This does not limit the rights of data subjects under Article 82 GDPR.

14. Governing law

Dutch law. The competent court is the one designated in Article 17 of the general terms and conditions.

15. Denkploeg's own processing and separation

1. Denkploeg processes for its own purposes and as controller: the data of users for logging in and security, the usage and the ledger, the security monitoring and the audit trail. That is set out in the privacy statement; this agreement does not apply to that processing.
2. The provider also uses Denkploeg for its own agency work. It never uses the Customer's data for that; see also the terms, Article 18.

Annex 1: data, data subjects and retention periods

Nature and purpose. Storing, displaying, organising, passing on to models and executing after approval, in order to support the work of the Customer and its agency: CRM (relations), communication (WhatsApp, support chat, email), marketing and advertising, websites, design and video.

Categories of data subjects: employees and users of the Customer and of its agency; customers and contact persons of the Customer (companies and private individuals); visitors to sites and users of the Customer's support chat; WhatsApp contacts; guests who open a share link, trial page or briefing form; recipients of a newsletter.

Types of personal data:

Special categories of personal data are not intended and there is no field for them; free text may contain them. The Customer decides whether to enter them and ensures that it does so only with a legal basis and with appropriate security. Denkploeg processes them only as part of that content, without distinguishing them, and on request assists with a data protection impact assessment.

Annex 2: technical and organisational measures

1. Encryption of secrets. Customers' keys and tokens are stored in the database with AES-256-GCM, with the workspace as additional authenticated data, so that a secret of one workspace cannot be decrypted in another. Secrets never appear in the audit trail, in logs or as a command argument. The master key is not included in the back-up.
2. Passwords and second step. Password as a scrypt hash with a constant-time comparison; no timing difference between a known and an unknown address. TOTP (RFC 6238) with the secret encrypted; recovery codes as a hash. A second step is mandatory for platform administrators and configurable per workspace or agency. Sensitive actions ask for a code from the last five minutes.
3. Sessions. The session token is stored only as a hash in the database; at most fourteen days; inactivity after sixty minutes (480 for platform administrators); cookie with httpOnly, SameSite=Lax and Secure.
4. Abuse limits. Login: eight attempts per address and twenty-five per origin in fifteen minutes. Public routes limit the size of a request and have a limit per IP address. The limit applies per process.
5. Separation between workspaces. Every row has a workspace id and every query a scope; a table without one gets a recorded reason, otherwise the check fails. Row-level security is enabled on part of the tables (including payments, discounts, the trial verification and Denkploeg's own newsletter), with a policy that applies as soon as a connection has set a workspace; the main separation relies on the application, with an isolation test.
6. Database roles. The application runs without superuser rights; there is a separate role for back-ups (read-only) and for monitoring.
7. Audit trail. Every action is recorded in the audit trail; a rule in the database ignores updates and deletions, and the application role may add but not change or delete. Older months go by hand to an archive with a checksum. Entries from before 14 October 2026 contain email addresses and IP addresses, new ones do not.
8. Human in the loop. An agent writes nothing outward without approval; an approval can be decided only once; the risk level comes from a human, not from a ticket. Only a builder writes, in a fresh working environment without customer secrets.
9. Isolation of untrusted code and files. The build crew's sandbox has no network, does not run as root, with all capabilities dropped and a read-only root. Untrusted files and websites go through separate isolated sandboxes.
10. Back-ups. Daily database dump on the same machine (7 days) and an encrypted external back-up (daily, kept 7 daily, 4 weekly, 6 monthly, weekly check of 5 percent); alarm for a back-up older than 36 hours. The external destination is a second Hostinger server in Paris, France. The restore test runs monthly.
11. Monitoring. A monitor checks the health of the apps and the worker and reports to Discord; push monitors in Uptime Kuma. Container logs are limited to 1 GB and 30 days.
12. Incidents and personal data breaches. We record a suspected breach immediately in an internal register (what, when discovered, which data, how many data subjects, which measures), even if it need not be reported (Article 33(5) GDPR). Within 24 hours we assess whether it is a breach. A breach affecting the Customer's data we report to the workspace owner within 24 hours of discovery; a breach for which we are ourselves the controller we report within 72 hours to the Dutch Data Protection Authority and, where necessary, to the data subjects (Articles 33 and 34 GDPR). A Customer reports a suspected breach to privacy@denkploeg.nl with "Data breach" in the subject; that address outside office hours, in an emergency, you can also use WhatsApp on +31 6 13816926; a message there is picked up by a human.
13. Web security. Content-Security-Policy with a nonce per request, object-src 'none', HSTS, nosniff, X-Frame-Options: DENY and a restrictive Permissions-Policy. The share domain sets no cookies.
14. Staff access. Platform administration requires a second step; looking into a workspace goes through break-glass access with a reason and a window of sixty minutes, visible in the Customer's history. Access to the server itself (SSH, database) is limited to the owner and leaves no entry in that history.
15. Retention periods. Periods are set in code in one place and run every hour.
16. Separation of keys. A workspace does not silently fall back on an agency key (only if the agency shares it). Without its own key, a workspace uses the platform key, only against credits that are reserved in advance.
17. Development. Changes go through a pull request; type checks and tests run locally before every merge; there is no automatic deployment. Migrations are immutable and numbered in sequence.

Annex 3: sub-processors and transfers

Below are all sub-processors of Denkploeg. Not every sub-processor touches the data of every workspace: Mollie, Moneybird, Cloudflare (Turnstile) and Google Workspace mainly process data for which Denkploeg itself is the controller (Article 15). The list with explanation is also at subprocessors.

Always on when the platform is used

Optional, turned on by the Customer (with its own account or key)

OpenAI, Recraft, Photoroom, fal, Vectorizer.AI, Ideogram, ElevenLabs, OpenArt, Higgsfield, Google (Analytics, Search Console, Tag Manager, Ads, Drive), Meta (Ads, Instagram, WhatsApp Cloud API), Kapso, Shopify, WooCommerce, Magento, Stripe, Mollie, Figma, GitLab, Bitbucket, WinningHunter, Context and other services from the service catalogue in the app. The Customer itself enters into the agreement with that service and is responsible for the transfer (Article 6(4) and (5)); Denkploeg sends data there only on the Customer's instructions.