DATA PROCESSING AGREEMENT (VERWERKERSOVEREENKOMST)
Version: 1.9.1
Date: 21 October 2026
Based on: Article 28 GDPR (Regulation (EU) 2016/679) and the UAVG (Dutch GDPR Implementation Act)
Publication location: https://noveu.eu/juridisch/verwerkersovereenkomst
This Data Processing Agreement ("DPA") forms an inseparable part of the Agreement between the Client (Controller) and Noveu Solutions (Processor) and prevails over the General Terms and Conditions insofar as the processing of Personal Data is concerned.
PARTIES
1. Controller ("Client"):
| Company name | [Customer company name] |
| Business address | [Address], [Postcode] [Town] |
| Chamber of Commerce number | [Chamber of Commerce number] |
| Represented by | [Name], [Position] |
| Contact (privacy) | [Email address] |
2. Processor:
| Company name | Noveu Solutions |
| Business address | Graskarpersingel 52, 2492 MV 's-Gravenhage |
| Chamber of Commerce number | 42030979 |
| Represented by | M. de Visser, owner |
| Contact (privacy) | privacy@noveu.eu |
Hereinafter jointly: the Parties.
RECITALS
A. The Parties have concluded a main agreement under which Noveu provides Services, possibly including: Noveu Workspace (SaaS), Noveu Webmail/Mail Hosting, Noveu Hosting, NoveuFlow (a WordPress plugin that runs on the Client's website), Managed IT, API and AI services (hereinafter: the "Main Agreement").
B. In performing the Main Agreement, Noveu processes Personal Data on behalf of the Client within the meaning of the GDPR.
C. This DPA complies with Article 28(3) GDPR and the UAVG and is based on the NLdigital model data processing agreement, adapted to the specific services of Noveu.
ARTICLE 1: DEFINITIONS
1.1. Capitalised terms that are not otherwise defined in this DPA have the meaning given in the GDPR or in Noveu's General Terms and Conditions.
1.2. Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
1.3. Sub-processor: a third party engaged by Noveu to process (part of) the Personal Data.
1.4. Supervisory Authority: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) or another competent supervisory authority.
ARTICLE 2: PURPOSE, NATURE AND LEGAL BASIS
2.1. Noveu processes the Personal Data exclusively on the instructions of the Client and for the performance of the Main Agreement, never for its own purposes.
2.2. The processing relates to the following purposes:
- (a) providing and managing the SaaS platform (Noveu Workspace); for NoveuFlow, a WordPress plugin on the Client's website, only licence management, updates and support. Data of the Client's customers in NoveuFlow remains on that website and is not processed by Noveu in the context of NoveuFlow, except what the Client itself includes in a support ticket (that falls under (g)); if the Client purchases the hosting of that website from Noveu, that processing falls under (c). The Client connects AI functions of NoveuFlow itself, with its own key, and they do not run via Noveu;
- (b) hosting, sending and storing email messages and attachments;
- (c) web and application hosting;
- (d) management and security of the Client's IT infrastructure;
- (e) appointments, calendar, contacts, CRM and project data;
- (f) backup and continuity;
- (g) support and helpdesk (ticketing);
- (h) optional: AI-assisted functions (only after explicit activation by the Client).
2.3. The Client warrants that the processing is based on a valid legal basis within the meaning of Article 6 GDPR and that Personal Data has been obtained lawfully.
2.4. The nature and duration of the processing correspond to the term of the Main Agreement, plus the retention periods referred to in Article 11.
ARTICLE 3: CATEGORIES OF PERSONAL DATA
3.1. In the context of the Services, the following categories of Personal Data may be processed:
| Category | Examples |
|---|---|
| Contact data | name, email, phone, address |
| Account data | username, hashed password, roles, MFA secret |
| Communication data | email content, attachments, chat/message content, metadata |
| Calendar and appointment data | calendar items, availability, participants |
| CRM/relationship data | customer files, notes, communication history |
| Files | documents that the Client uploads or stores |
| Technical data | IP addresses, logs, device info, session data |
| Billing data | billing address, VAT, IBAN (via Stripe) |
| Special categories (Art. 9 GDPR) | only if expressly agreed and with additional measures (see 3.3) |
3.2. Categories of data subjects:
- (a) employees and staff of the Client;
- (b) customers and contacts of the Client;
- (c) suppliers and business partners of the Client;
- (d) visitors to the Client's websites;
- (e) patients/clients (only in a healthcare context, see 3.3);
- (f) job applicants.
3.3. Special categories and healthcare context (NTA 7516). If the processing relates to special categories of personal data (Art. 9 GDPR), including health data:
- (a) the Client informs Noveu of this expressly and in advance;
- (b) the Parties take additional measures in accordance with Annex 1;
- (c) for email in healthcare, Noveu applies (if agreed) the standards of NTA 7516 (Secure email in healthcare);
- (d) the Client ensures a valid legal basis in accordance with Article 9(2) GDPR.
ARTICLE 4: OBLIGATIONS OF THE PROCESSOR
4.1. Noveu processes the Personal Data exclusively on the basis of instructions In Writing from the Client, unless required to do so by Union law or Dutch law. In that case Noveu informs the Client in advance, unless the law prohibits this.
4.2. Noveu does not process Personal Data outside the EEA, unless the Client has given consent In Writing for this and appropriate safeguards (Chapter V GDPR) have been put in place.
4.3. Noveu informs the Client without delay if, in Noveu's opinion, an instruction infringes the GDPR or other privacy legislation.
4.4. Noveu provides reasonable cooperation with DPIAs (Art. 35 GDPR) and prior consultation (Art. 36 GDPR).
4.5. Noveu keeps a record of processing activities in accordance with Article 30(2) GDPR.
ARTICLE 5: SECURITY (TOMs)
5.1. Noveu takes appropriate technical and organisational measures in accordance with Article 32 GDPR, taking into account the state of the art.
5.2. A detailed overview of the TOMs is included in Annex 1. In outline, Noveu takes at least the following measures:
- (a) TLS 1.2+ for external traffic, HSTS, modern ciphers;
- (b) backups have been stored encrypted since 30 September 2026; the disks themselves are not yet encrypted and we are not giving a date for that yet;
- (c) RBAC with the least-privilege principle;
- (d) mandatory MFA for all administrative access;
- (e) central logging, monitoring (Prometheus/Grafana) and error tracking (GlitchTip);
- (f) daily automated backups. Backups are stored in the Hetzner data centre in Falkenstein (Germany). Backups have been stored encrypted since 30 September 2026; the disks themselves are not yet encrypted and we are not giving a date for that yet; periodic restore tests will be implemented as soon as the first production customers are connected;
- (g) patch management (critical CVEs within 48 hours);
- (h) Cloudflare Tunnel for HTTP traffic, no direct inbound internet access to the web backend (mail traffic and STUN/TURN go directly to our server at Hetzner in Falkenstein, Germany, not via Cloudflare);
- (i) segmentation of environments and data isolation per service.
5.3. Noveu evaluates these measures periodically and adapts them to the state of the art. Material changes are communicated to the Client.
ARTICLE 6: SUB-PROCESSORS
6.1. The Client hereby gives Noveu general authorisation to engage Sub-processors, under the conditions of this article.
6.2. The Sub-processors engaged at the time of publication are listed in Annex 2 and on /en/legal/sub-processors. The Client consents to this.
6.3. Noveu announces intended changes (addition or replacement) In Writing at least 30 days in advance, among other ways via email and https://noveu.eu/juridisch/sub-verwerkers.
6.4. The Client may object on reasoned grounds within that period. If consultation does not lead to agreement within 14 days, the Client may terminate the Main Agreement with a notice period of 30 days, without compensation.
6.5. Noveu imposes at least equivalent obligations on every Sub-processor and remains fully liable to the Client for performance by Sub-processors.
ARTICLE 7: DATA BREACH NOTIFICATION
7.1. Noveu informs the Client without undue delay and at the latest within 48 hours of discovering a Data Breach, so that the Client can comply in time with the statutory obligation to notify the AP (72 hours, Art. 33 GDPR).
7.2. The notification contains at least, insofar as known at that time:
- (a) the nature of the Data Breach, the categories and approximate number of data subjects and Personal Data;
- (b) the contact details of the officer/contact person at Noveu;
- (c) the likely consequences;
- (d) the measures already taken and proposed.
7.3. Missing information is supplemented in phases.
7.4. Noveu documents all Data Breaches in an internal register (Art. 33(5) GDPR) and makes it available on request.
7.5. Noveu provides reasonable cooperation to the Client in: limiting the consequences, investigation, notifications to the Supervisory Authority and/or data subjects (Art. 33 to 34 GDPR inclusive), and follow-up questions from the Supervisory Authority.
7.6. Noveu makes no statements to third parties about a Data Breach without consent In Writing, unless required by law.
ARTICLE 8: RIGHTS OF DATA SUBJECTS (DSR ASSISTANCE)
8.1. The Client itself is responsible for handling requests from data subjects (Art. 15 to 22 GDPR inclusive): access, rectification, erasure, restriction, data portability, objection and automated decision-making.
8.2. Noveu supports the Client within a period of 30 days after receipt of a request In Writing, unless a shorter period is reasonably necessary to stay within statutory deadlines.
8.3. If Noveu receives a request directly from a data subject, it forwards it to the Client as soon as possible without responding to the substance, unless agreed otherwise In Writing.
8.4. Reasonable costs of support may be charged at Noveu's then applicable rate, provided that this is communicated in advance.
ARTICLE 9: CONFIDENTIALITY
9.1. Noveu undertakes to keep all Personal Data and other confidential information confidential.
9.2. Noveu ensures that all persons acting under its authority who have access to Personal Data (employees, temporary staff and freelancers) are bound by a statutory or contractual duty of confidentiality.
9.3. Confidentiality remains in force after termination for an indefinite period or as long as confidentiality requires.
ARTICLE 10: AUDIT
10.1. Noveu makes available to the Client all information reasonably required to demonstrate compliance with Article 28 GDPR.
10.2. The Client has the right to carry out an audit (or have one carried out) once per calendar year, under the following conditions:
- (a) announcement In Writing at least 20 working days in advance;
- (b) during regular office hours, by appointment;
- (c) with due regard to the confidentiality of other customers;
- (d) by an independent, qualified auditor bound by confidentiality.
10.3. Additional audits are permitted in the event of: a Data Breach (Art. 7), an investigation by the Supervisory Authority, or well-founded reasons to suspect non-conformity.
10.4. Instead of a physical audit, Noveu may offer a recent (max 12 months old) external audit report, ISO 27001 / SOC 2 / ISAE 3402 certification or an equivalent independent statement. A physical audit is only permitted if the documentation offered is insufficient.
10.5. Audits are at the Client's expense, unless they show that Noveu does not comply with its obligations; in that case Noveu bears the reasonable costs.
10.6. Noveu cooperates with investigations by the Supervisory Authority insofar as they relate to this DPA.
ARTICLE 11: RETURN AND DELETION
11.1. Upon termination of the Main Agreement, Noveu ceases the processing, subject to statutory retention obligations.
11.2. At the Client's request, Noveu makes the Personal Data available in a common and machine-readable format (CSV, JSON, SQL export, MBOX for mail) within 30 days. The Client has 30 days after termination to submit a request for return.
11.3. After return, or after the period in 11.2 has expired without a request, Noveu deletes all Personal Data and copies within 30 days.
11.4. Backups containing Personal Data are overwritten or deleted no later than 90 days after termination. During that period, the security and confidentiality obligations continue to apply in full.
11.5. Noveu confirms the deletion In Writing on request.
ARTICLE 12: LIABILITY
12.1. The Client is and remains responsible for compliance with the GDPR with regard to the processing for which it is the controller.
12.2. Noveu is liable for damage insofar as it:
- (a) has not complied with the GDPR obligations specifically directed at processors; or
- (b) has acted contrary to lawful instructions of the Client; or
- (c) has acted outside or contrary to the instructions.
12.3. A Party is exempt from liability if it proves that it is not in any way responsible for the event giving rise to the damage (Art. 82(3) GDPR).
12.4. The limitations of liability from the General Terms and Conditions (Article 13) apply mutatis mutandis, on the understanding that they do not apply in the case of liability under mandatory GDPR law or breach of the duty of confidentiality (Article 9).
12.5. If a data subject claims damages, the Parties inform each other without delay and cooperate reasonably in handling the claim. If one Party pays compensation, it may recover the part corresponding to the responsibility of the other Party.
ARTICLE 13: TERM AND FINAL PROVISIONS
13.1. This DPA enters into force when the Main Agreement is concluded and ends by operation of law upon its termination. Provisions that by their nature continue (confidentiality, deletion, liability) remain in force.
13.2. Amendments and additions are only valid if agreed In Writing.
13.3. In the event of conflict with the Main Agreement, this DPA prevails insofar as the processing of Personal Data is concerned.
13.4. Dutch law applies to this DPA. Disputes are submitted to the District Court of The Hague (Rechtbank Den Haag), without prejudice to the right of the Parties to mediation or arbitration.
13.5. The core processing and storage of Personal Data takes place within the EEA. For the sub-processors outside the EEA that are specifically named (see Annex 2), appropriate safeguards have been put in place in accordance with Chapter V GDPR (EU-US Data Privacy Framework and/or Standard Contractual Clauses, as stated per sub-processor in Annex 2). Changes to these safeguards or to the list of non-EEA sub-processors are announced in advance in accordance with Article 6.
SIGNATURE
Agreed as follows:
Controller:
| Name | [Name of representative] |
| Position | [Position] |
| Date | [Date] |
| Signature | _________________________ |
Processor (Noveu Solutions):
| Name | M. de Visser |
| Position | Owner |
| Date | [Date] |
| Signature | _________________________ |
ANNEX 1: TECHNICAL AND ORGANISATIONAL MEASURES
A. Infrastructure and network
| Measure | Specification |
|---|---|
| Primary hosting location | Hetzner Dedicated, Falkenstein (Germany), own hardware, Proxmox VE |
| Backup location | Backups are stored in the Hetzner data centre in Falkenstein (Germany). Backups have been stored encrypted since 30 September 2026. The disks themselves are not yet encrypted; we are not giving a date for that yet. |
| Mail infrastructure | Stalwart mail server on vm-mail (10.10.10.11): EU-hosted |
| Edge/DDoS | Cloudflare (global network): DDoS mitigation, WAF, DNSSEC |
| Inbound architecture | HTTP traffic via Cloudflare Tunnel (web backend without a public port); mail traffic (the SMTP, IMAP and JMAP protocols) and STUN/TURN directly to our own server at Hetzner in Falkenstein, not via Cloudflare |
| Network segmentation | Docker networks per service; only the API gateway is reachable externally |
| Firewall | Host firewall + Proxmox/VM firewall; whitelisting |
B. Application security
| Measure | Specification |
|---|---|
| Authentication | JWT + refresh tokens; Redis-backed sessions |
| MFA | TOTP mandatory for all management and admin accounts |
| Authorisation | RBAC with granular rights per service |
| API gateway | Rate limiting, input validation, CORS, auth header propagation |
| Password storage | bcrypt / Argon2, never plaintext |
| TLS | TLS 1.2+ mandatory, HSTS, modern ciphers |
C. Email security
| Measure | Specification |
|---|---|
| Transport | STARTTLS mandatory; MTA-STS enabled |
| Authentication | SPF, DKIM, DMARC per domain; ARC for forwarding |
| Spam filter | Active spam and malware filtering (Stalwart) |
| NTA 7516 | Optional for healthcare customers, agreed separately |
D. Data management
| Measure | Specification |
|---|---|
| Encryption at rest | The disks themselves are not yet encrypted; we are not giving a date for that yet. Backups have been stored encrypted since 30 September 2026. Encryption in transit: TLS 1.2 or higher, TLS 1.3 is supported. |
| Data isolation | Own schema per service; logical separation per tenant/organisation |
| Backups | Automated daily, retention 30 days (periodic restore tests will be implemented after the first production customer) |
| Data portability | Export in CSV, JSON, SQL and MBOX (mail) |
| Deletion | Automated wipe upon termination (art. 11 DPA) |
E. Access management and staff
| Measure | Specification |
|---|---|
| Least privilege | Production access only for authorised engineers |
| MFA management | Mandatory for SSH, Proxmox, Portainer, Grafana, databases |
| Logging | Admin access + changes logged; stored centrally |
| NDA | All employees and temporary staff sign an NDA |
| Offboarding | Access rights revoked within 24 hours after leaving employment |
F. Monitoring and incident response
| Measure | Specification |
|---|---|
| Monitoring | Prometheus + Grafana (vm-monitoring) |
| Error tracking | GlitchTip (errors.noveu.eu) |
| Detection | Automated alerts on anomalies and failures |
| Data breach notification | Within 48 hours to the Client (art. 7 DPA) |
| Incident register | All incidents documented and periodically evaluated (RCA) |
G. Organisational
| Measure | Specification |
|---|---|
| Security policy | Documented internal security policy |
| Awareness | Periodic security training for employees |
| Supplier management | Sub-processors screened and contractually bound |
| Change management | Changes via version control (Git) + review |
ANNEX 2: OVERVIEW OF SUB-PROCESSORS
Current state at the time of publication. A current overview is available at /en/legal/sub-processors.
| # | Sub-processor | Establishment | Processing location | Purpose/Service | Categories of data | Safeguard |
|---|---|---|---|---|---|---|
| 1 | Hetzner Online GmbH | Germany (EU) | Falkenstein (DE) | Dedicated server, storage and backups | All categories art. 3 | GDPR: EU entity |
| 2 | Cloudflare, Inc. | US (EU entity available) | Cloudflare's global network, not limited to the EU | CDN, DDoS, DNS, Tunnel | IP addresses, metadata, TLS termination | EU-US DPF + SCCs + DPA |
| 3 | Stripe Payments Europe Ltd. | Ireland (EU) | EU | Payment processing (cards, iDEAL, SEPA) | Billing, company and payment data | GDPR: EU entity + DPA |
| 4 | Mistral AI SAS | France (EU) | EU | AI functionality (Noveu AI), LLM text generation only, only upon explicit activation. Embeddings are not sent to Mistral; they run on-premise (see self-hosted infrastructure below). | Only content that the user submits to the AI | GDPR: EU entity + Mistral DPA + data minimisation/pseudonymisation in the Noveu AI gateway |
Retired:
| Sub-processor | Role | Retired as of |
|---|---|---|
| Google LLC (Gemini API) | AI, LLM text generation | 29 August 2026 |
Notes:
- The AI processor (Mistral AI SAS, Paris) is used only after explicit activation per feature and solely for LLM text generation. Only content submitted by the user is sent; this paid API tier does not train on customer data. The embeddings (vectorisation) and the vector store are self-hosted (BAAI
bge-m3via self-hosted Text-Embeddings-Inference + pgvector on our own Hetzner infrastructure, EU); no external embedding API or external vector database is used. Anthropic, OpenAI, Google and Pinecone are not in use. - Change of AI processor. Google LLC (Gemini API, US) was replaced by Mistral AI SAS (France, EU processing) as of 29 August 2026. The notice in accordance with article 6.3 was published on 31 August 2026 on /en/legal/sub-processors; the objection period runs until and including 31 October 2026, the same as on the sub-processors page. The switch moves the AI processing from outside to inside the EEA and does not add a sub-processor.
- For US processors, additional measures have been taken in accordance with Schrems II (SCCs, data minimisation, encryption in transit via TLS 1.2 or higher, US CLOUD Act risk analysis). After the change above, Cloudflare is the only remaining sub-processor with a US nexus.
- A detailed overview including links to sub-processor DPAs is at /en/legal/sub-processors.
ANNEX 3: PROCESSING ACTIVITIES
| # | Activity | Categories of data | Data subjects | Retention period |
|---|---|---|---|---|
| 1 | Noveu Workspace (SaaS) | Contact, account, CRM, calendar, file and communication data | Employees, customers, contacts | Term of agreement + 30 days |
| 2 | NoveuFlow (WordPress plugin): licence, updates and support | Licence key, email address of the administrator or licence holder, domain and site URL, plugin version and timestamps; for a support ticket also the free text, WordPress, PHP and plugin version, plan and sector. The plugin itself does not send any data of the Client's customers; what the administrator puts in a support ticket falls under row 6 | Administrator or licence holder of the Client | Licence and update data: term of licence + 30 days; support tickets: 24 months after closing the ticket (row 6) |
| 3 | Mail Hosting (Stalwart) | Communication data, contact data, metadata | Employees, customers, contacts | Term of agreement + 30 days |
| 4 | Web hosting | Website data, technical data | Website visitors | Term of agreement + 30 days |
| 5 | Managed IT services | Account and technical data | Employees | Term of agreement + 30 days |
| 6 | Support/ticketing | Contact and communication data | Employees, customers | 24 months after closing the ticket |
| 7 | Payment processing (Stripe) | Invoice and payment data | Contact persons | Tax retention period 7 years |
| 8 | AI services (optional) | Content submitted by the user; derived embeddings | Depending on use | Mistral (LLM text, EU) does not train on customer data; derived embeddings are generated locally (on-premise) and stored in the self-hosted EU vector store (pgvector) as long as the AI function is active |
| 9 | Backups | All categories mentioned above | All mentioned above | Maximum 90 days after termination |
| 10 | Error/monitoring logs | Technical data, event IDs | Users | 30 days |
CHANGELOG
| Version | Date | Change |
|---|---|---|
| 1.9.1 | 21 October 2026 | Factual correction: Mollie B.V. is not a sub-processor or payment service provider of Noveu and has been removed. Changed are Article 3.1 (row Billing data: payments only run via Stripe), Annex 2 (row 4, Mollie B.V., is removed; Mistral AI SAS is now row 4; for Stripe, iDEAL is now named as a payment method, in line with the general terms and conditions) and Annex 3 (row 7, Payment processing: Stripe only). The other parts are unchanged. |
| 1.9 | 14 October 2026 | Factual correction. Backups have been stored encrypted since 30 September 2026. The disks themselves are not yet encrypted; we are not giving a date for that yet. The date previously planned for encrypting the disks has been withdrawn. Changed are article 5.2 (measures b and f), Annex 1 A (backup location) and Annex 1 D (data management). The retention periods and the other articles and annexes are unchanged. |
| 1.8 | 7 October 2026 | Factual correction to the measured state of 30 September 2026: backups have been stored encrypted since 30 September 2026. Encryption of other storage at rest is being introduced (planned for October 2026). Changed are article 5.2 (measures b and f), Annex 1 A (backup location) and Annex 1 D (data management). The retention periods and the other articles and annexes are unchanged. |
| 1.7 | 30 September 2026 | Factual correction to the measurement of 30 September 2026: correction of the description of Cloudflare and of the mail and STUN/TURN services. Annex 1 A and Annex 2 (row 2) named EU data centres; Cloudflare processes the traffic in its global network, not limited to the EU. Annex 1 A (inbound architecture): mail traffic and STUN/TURN go directly to our own server at Hetzner in Falkenstein, not via Cloudflare. Annex 1 D and Annex 2 (notes): encryption in transit is TLS 1.2 or higher, TLS 1.3 is supported. Art. 5.2(h) described the mail and STUN/TURN ports as hardened; that had not been measured and has been deleted. No new or replaced sub-processor and no change to the obligations. |
| 1.6 | 29 September 2026 | Factual correction to the measured state of 29 September 2026. Changed are article 5.2 (measures b and f), Annex 1 A (backup location) and Annex 1 D (data management). Annex 1 A named encrypted backups as active, but there were no encrypted backups at that time. The new text in those places: backups are stored in the Hetzner data centre in Falkenstein (Germany); encryption of backups and storage at rest is being introduced (planned for October 2026). Entry 1.4 has been annotated as incorrect. Apart from the parts named here, the articles and annexes are unchanged. |
| 1.5 | 28 September 2026 | Annex 2 (note "Change of AI processor"): the objection period for the switch from Google LLC to Mistral AI SAS runs until and including 31 October 2026 instead of 30 September 2026, the same as on the sub-processors page (version 1.4). Apart from this note, the articles and annexes are unchanged. |
| 1.4 | 28 September 2026 | Article 5 (measure f), Annex 1 (backup location) and Annex 2 (row 1, Hetzner): data location corrected to the measured state of 26 September 2026. Data and encrypted backups are stored in a Hetzner data centre in Falkenstein (Germany); the earlier mention of a separate backup location and of replication to another location has been removed. No new or replaced sub-processor; the number of active sub-processors remains five. In the historical entry of version 1.0, the name of the former backup location has been replaced by a description. Recital A, article 2.2(a) and Annex 3 (row 2, NoveuFlow): NoveuFlow is a WordPress plugin on the Client's website; for it, Noveu only processes licence, update and support data and no data of the Client's customers. Apart from the parts named here, the articles and annexes are unchanged. (incorrect; corrected in v1.6) |
| 1.3 | 31 August 2026 | Switch of AI sub-processor implemented in Annex 2 and Annex 3. Google LLC (Gemini API, US) has been replaced by Mistral AI SAS (France, processing within the EU). The technical switch took place on 29 August 2026; the notice in accordance with article 6.3 was published on 31 August 2026 on /juridisch/sub-verwerkers, with an objection period until and including 30 September 2026. Until this version the documents lagged behind reality: they named Google as the current AI processor and Mistral as a roadmap option. Specifically changed: (a) Annex 2 row 5 replaced; (b) a section "Retired" added with Google and the date 29 August 2026; (c) the note under Annex 2 rewritten, including the finding that after this change Cloudflare is the only remaining sub-processor with a US nexus; (d) Annex 3 row 8 (AI services) from Google to Mistral. No change in the categories of data, the retention periods or the rest of the agreement. |
| 1.2 | 5 July 2026 | Correction of article 13.5: the provision stated that processing takes place exclusively within the EEA and that no SCCs are needed, while Annex 2 lists EU-US DPF + SCCs as the safeguard for Cloudflare (US) and Google/Gemini (US). Article 13.5 now reads: core processing and storage within the EEA; for the non-EEA sub-processors named in Annex 2, appropriate safeguards apply in accordance with Chapter V GDPR (DPF and/or SCCs); changes are announced in advance in accordance with article 6. No change in the actual processing, only bringing article 13.5 in line with the already published Annex 2. |
| 1.1 | 16 June 2026 | Correction of the sub-processor list to the actual production state: the only external AI processor is Google (Gemini API), solely for LLM text generation. Anthropic and OpenAI have been removed: not in use. Embeddings and vector store are self-hosted/on-premise (BAAI bge-m3 via self-hosted Text-Embeddings-Inference + pgvector on our own Hetzner EU infrastructure); no external embedding API and no external vector database (Pinecone not in use). Annex 3 "Zero-retention (no storage)" for AI corrected: derived embeddings are stored locally in the self-hosted EU vector store. Mistral (Paris) named as an EU-sovereign roadmap option, not as the current state. |
| 1.0 | 9 June 2026 | First version ready for publication, based on an internal template (NLdigital basis). Changes compared to the template: (a) sub-processor list fully updated: Strato replaced by Hetzner (Falkenstein plus a separate backup location; corrected in version 1.4), Stripe and Mollie explicit, Anthropic added as primary AI, OpenAI as optional alternative (Annex 2); (b) TOMs extended with current Noveu infrastructure: Cloudflare Tunnel, Stalwart, Proxmox, Prometheus/Grafana, GlitchTip (Annex 1); (c) data breach notification period changed to 48 hours (art. 7); (d) DSR assistance period made explicit at 30 days (art. 8); (e) audit regime clarified, 1x/year by appointment, ISO/SOC2 report acceptable (art. 10); (f) NTA 7516 explicitly named as optional for healthcare customers (art. 3.3); (g) added: processing exclusively within the EEA, no SCCs needed (art. 13.5); (h) Dutch forum laid down as the District Court of The Hague (art. 13.4); (i) Annex 3 retention periods made concrete (support 24m, error logs 30d, AI zero-retention). |
Related documents:
- General Terms and Conditions Noveu B2B, /en/legal/terms
- Privacy statement, /en/legal/privacy
- Current sub-processors, /en/legal/sub-processors
- Status and incidents page,
https://status.noveu.eu