This is a translation. In case of differences, the Dutch text prevails. Lees de Nederlandse tekst
Data Processing Agreement (DPA)
If Noveu processes personal data for your organisation, a Data Processing Agreement (DPA) is mandatory under Article 28 GDPR. Below you can download the draft version.
DPA v1.9.1, 2026-10-21
Based on GDPR art. 28, the UAVG and the NLdigital model data processing agreement. Including annexes: (1) Technical and Organisational Measures, (2) Sub-processors, (3) Processing activities.
Download DPA-v1.9.1 (PDF, Dutch, prevailing text)Prefer to read it online first? The full text of version 1.9.1 is on the Data Processing Agreement page.
What is a DPA?
A data processing agreement (DPA) sets out which personal data Noveu processes on your behalf and under which arrangements; Article 28 GDPR makes it mandatory as soon as an external party does so. In our blog you can read what a data processing agreement means and when you need one.
What does this DPA contain?
- Parties, purpose, nature and legal basis of the processing
- Categories of personal data and data subjects
- Technical and organisational measures (TOMs)
- Sub-processors: Hetzner, Cloudflare, Stripe, Mistral AI (LLM text only)
- Data breach notification obligation (within 48 hours)
- Assistance with data subject rights (art. 15 to 22 GDPR inclusive)
- Confidentiality, audit regime (1x/year)
- Return and deletion upon termination
- Liability and governing law (Dutch law, District Court of The Hague)
Custom terms or questions?
For larger organisations, government bodies or healthcare institutions, custom DPA terms are open to discussion, for example additional NTA 7516 provisions for healthcare or BIO alignment for government.
Contact us via contact@noveu.eu for DPA negotiation or specific processing requirements.