Version 1.7 October 2026
This data processing agreement forms part of the agreement between Pluvo B.V. (“Processor”) and the customer (“Controller”), and takes effect on the date on which you have accepted this data processing agreement. You warrant that you are authorised to enter into this data processing agreement. If you do not have this authority, we ask you not to accept this agreement.”
Whereas:
- The Controller operates in the field of training/education and uses the Processor in that context;
- The Processor provides the Controller with the Service as described in the Agreement, and in that capacity processes (special categories of) personal data for the Controller;
- The Controller qualifies, with regard to the processing of personal data, as controller within the meaning of Article 4(7) of the General Data Protection Regulation (“GDPR”);
- The parties wish – partly in order to implement Article 28(3) GDPR – to lay down in this Data Processing Agreement a number of terms that apply to their relationship in connection with the (processing of personal data in the context of the) aforementioned activities for and on behalf of the Controller.
- The Processor qualifies, with regard to storing and processing the personal data for the Controller, as processor within the meaning of Article 4(8) GDPR;
Agree as follows:
Article 1. Definitions
- In this Data Processing Agreement, the following terms, always written with a capital letter, have the following meaning regardless of whether they are used in the singular or plural:
Annex: appendix to the Data Processing Agreement, which forms an integral part of the Data Processing Agreement.
Agreement: the Pluvo Customer Agreement concluded between the Controller and the Processor;
Personal Data: all data that is directly or indirectly traceable to a natural person as referred to in Article 4(1) GDPR;
Sub-processor: the subcontractor engaged by the Processor, who Processes Personal Data on behalf of the Controller in the context of this Data Processing Agreement, as referred to in Article 28(4) GDPR;
Process/Processing: the processing of Personal Data as referred to in Article 4(2) GDPR;
Data Processing Agreement: this agreement, which forms part of the Agreement. - The provisions of the Agreement apply in full to the Data Processing Agreement. Insofar as the Agreement contains provisions regarding the processing of personal data, the provisions of this Data Processing Agreement shall prevail.
Article 2. Controller and Processor of the data
- The Processor undertakes, in the context of this Data Processing Agreement, to Process Personal Data on behalf of the Controller. An overview of the type of Personal Data, the categories of data subjects and the purposes for which the Processing of Personal Data takes place is set out in Annex 1.
- The Controller is liable for the Processing of Personal Data under the Agreement and warrants that the instruction to Process that Personal Data complies with all applicable laws and regulations. The Controller indemnifies the Processor against all third-party claims, in particular from the supervisory authority, arising in any way from non-compliance with this warranty.
- The Processor undertakes to Process personal data solely for the activities referred to in this Data Processing Agreement and/or the Agreement. The Processor warrants that, without the express written consent of the Controller, it will not use the Personal Data Processed under this Data Processing Agreement, unless a statutory provision applicable to the Processor obliges it to do so. In that case, the Processor shall inform the Controller of that statutory provision prior to the Processing, unless that legislation prohibits such notification for important reasons of public interest.
- Free-text fields and special categories of personal data
- The Processor processes data entered via free-text fields solely for the purpose of the technical provision, hosting, storage, security, back-up and (deletion) of that data. The Processor does not carry out any substantive review or active review of the content entered via free-text fields.
- Unless expressly agreed in writing, the Controller is not permitted to process special categories of personal data within the meaning of Article 9 GDPR, or a Dutch citizen service number (BSN), via free-text fields. If the Controller nevertheless does so, it shall ensure a valid legal basis and appropriate additional safeguards, and shall notify the Processor of this in writing beforehand.
- Data that is temporarily stored in the context of system tasks (such as verification, export or deletion procedures) is stored in encrypted form, logged, and automatically deleted after completion of the task, in accordance with Annex 2.
- The Processor facilitates configurations and UI warnings that alert the Controller to the prohibition or conditions for entering special categories of personal data via free-text fields.
- The Processor contractually imposes these obligations on any Sub-processors that have access to this data.
Article 3. Technical and organisational measures
- The Processor shall, taking into account the nature of the processing and insofar as reasonably possible, assist the Controller in complying with its obligation under the GDPR to take appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These measures shall, taking into account the state of the art and the costs of implementation, guarantee a level of security appropriate to the risks posed by the Processing and the nature of the data to be protected. The Processor shall in any case take measures to protect Personal Data against destruction, whether accidental or unlawful, against accidental and intentional loss, falsification, unauthorised distribution or access, or against any other form of unlawful Processing.
- The technical and organisational measures taken by the Processor are described in Annex 2. The Controller acknowledges having taken note of the relevant measures and, by signing this Data Processing Agreement, agrees to the measures taken by the Processor.
Article 4. Confidentiality
- The Processor shall have its employees who are involved in the performance of the Agreement sign a confidentiality statement – whether or not included in the employment contract with those employees – which states in any case that these employees must observe confidentiality with regard to the Personal Data.
Article 5. Data processing outside the Netherlands
- The transfer of Personal Data by the Processor outside the European Economic Area is only permitted in compliance with the applicable statutory obligations.
Article 6. Third parties and subcontractors
- The Processor is permitted, in the context of this Data Processing Agreement and the Agreement, to make use of Sub-processors, as set out in Annex 3. If the Processor wishes to engage another Sub-processor, the Processor shall inform the Controller of the intended changes. The Controller must object to these changes within 5 working days. The Processor shall respond to the Controller’s objection within 4 working days.
- The Processor contractually obliges every Sub-processor to observe the confidentiality obligations, notification obligations and security measures relating to the Processing of Personal Data, which obligations and measures must at least comply with the provisions of this Data Processing Agreement.
Article 7. Liability
- With regard to the liability of the Processor under the Data Processing Agreement, as well as the indemnification obligations for the Processor set out in the Data Processing Agreement, the arrangement regarding the limitation of liability set out in, among other things, Article 9 of the Agreement applies in full.
- Without prejudice to Article 7.1 of this Data Processing Agreement, the Processor is only liable for damage caused by the Processing where this Processing has failed to comply with obligations under the GDPR specifically directed at the Processor, or where it has acted contrary to the lawful instructions of the Controller.
Article 8. Incidents
- If the Processor becomes aware of an incident that may have a (substantial) impact on the security of Personal Data, it shall i) inform the Controller thereof without undue delay, and ii) take all reasonable measures to prevent or limit (further) breach of the GDPR.
- The Processor shall, insofar as reasonable, provide its cooperation to the Controller and support the Controller in fulfilling its statutory obligations with regard to the identified incident.
- The Processor shall, insofar as reasonable, support the Controller with the notification obligation resting on the Controller regarding a personal data breach to the Dutch Data Protection Authority (“AP”) and/or the data subject, as referred to in Article 33(3) and Article 34(1) GDPR. The Processor is never obliged to independently notify the AP and/or the data subject of a personal data breach.
- The Processor is never liable for the (correct and/or timely performance of the) notification obligation resting on the Controller as referred to in Articles 33 and 34 GDPR.
Article 9. Assistance to the Controller
- The Processor shall, insofar as reasonably possible, assist the Controller in fulfilling its obligation under the GDPR to respond to requests for the exercise of a data subject’s rights, in particular the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction (Art. 18 GDPR), portability (Art. 20 GDPR) and the right to object (Art. 21 and 22 GDPR). The Processor shall forward any complaint or request from a data subject regarding the Processing of Personal Data to the Controller as soon as possible, who is responsible for handling the request. The Processor is entitled to charge the Controller for any costs involved in this cooperation.
- The Processor shall, insofar as reasonably possible, assist the Controller in complying with its obligation under the GDPR to carry out a data protection impact assessment (Art. 35 and 36 GDPR).
- The Processor shall provide the Controller with all information reasonably necessary to demonstrate that the Processor complies with its obligations under the GDPR. Furthermore, at the Controller’s request, the Processor shall enable and contribute to audits, including inspections, carried out by the Controller or an auditor authorised by the Controller. If the Processor is of the opinion that an instruction in connection with the provisions of this article constitutes a breach of the GDPR or other privacy legislation applicable to it, the Processor shall immediately inform the Controller of this.
- The Processor is entitled to charge the Controller for any costs involved in the provisions of Article 9.3.
Article 10. Termination & miscellaneous
- With regard to termination and/or dissolution of this Data Processing Agreement, the specific provisions of the Agreement apply. Without prejudice to the specific provisions of the Agreement, the Processor shall, at the Controller’s first request, delete all Personal Data or return it to the Controller, and delete existing copies, unless the Processor is legally obliged to continue storing (part of) the Personal Data.
- The Controller shall adequately inform the Processor about (statutory) retention periods applicable to the Processing of Personal Data for the Processor.
- The Controller declares that it is authorised to enter into this Data Processing Agreement.
- The obligations under this Data Processing Agreement that are by their nature intended to survive termination shall remain in force after termination of this Data Processing Agreement.
- The choice of law and competent court correspond to the provisions of the Agreement.
----------------------------
Annex 1. Overview of Personal Data
Type of personal data
The following categories of personal data may be processed by the Processor on behalf of the Controller:
- Basic identification information: Name, email address, profile picture
- Custom user fields: Fields added by the Controller, specific to their operational needs.
- Educational data: progress in course material, scores and results of evaluations and tests
The Controller retains the autonomy to determine which personal data are processed through the Processor’s software. This includes both the basic identification information and the specific custom fields relevant to their purposes.
Free-text fields – scope and limitations
Free-text fields can be configured by the Controller.
The Controller shall ensure that no special categories of personal data (Article 9 GDPR) or BSN (Dutch citizen service number) are processed via these fields, unless a valid legal basis and additional safeguards exist for this and the Processor has been notified in advance.
In all cases, purpose limitation, data minimisation and the retention and deletion periods set out in this Data Processing Agreement apply in full.
Dynamic nature of data
Given the Controller’s ability to add custom fields, there is an inherently dynamic aspect to the types of personal data processed.
The Processor facilitates transparency by providing insight into the current set of personal data processed within the customer environment.
Access to data
An up-to-date and complete overview of the personal data processed is accessible to the Controller after logging in to the account within the Processor’s supplied software.
This access enables the Controller to regularly review the types of data collected and, where necessary, update them to ensure accuracy and relevance.
Transparency and compliance
This specification of personal data is drawn up in the spirit of transparency and compliance with the GDPR, with the privacy and protection of user data as a priority.
Purposes of processing
The processing of personal data by the Processor takes place for specific purposes determined by the Controller. These purposes concern the personal data of natural persons (data subjects) who:
- have a relationship with the Controller (such as customers, members, students, employees or participants);
- participate in training or courses offered by the Controller.
These purposes include, among other things:
- communication with data subjects;
- carrying out research or evaluations;
- compliance with statutory obligations;
- performance of agreements with data subjects.
Processing activities
The processing activities are carried out independently by the Controller or the data subject, using the Processor’s systems. These activities include, but are not limited to:
- collecting, recording, organising, segmenting, filtering and structuring data;
- storing data, including email communication and chat logs;
- updating, modifying, synchronising, enriching and analysing data;
- retrieving, consulting, using, sharing, disseminating or otherwise making data available;
- aligning, combining, restricting, erasing or destroying data.
This list provides a complete overview of the possible interactions with personal data within the Processor’s systems and the diversity of the processing operations.
Use of AI functionality
When the Controller uses the AI functionality within the Pluvo platform (including the course module builder and automatic translation functionality), text entered by the Controller or its users (“prompts”) may be temporarily processed by the sub-processor OpenAI LLC for the purpose of generating draft learning content and/or translating existing learning content.
Pluvo acts as processor in this respect. The Controller remains fully responsible for the lawfulness of the processing and for the content of the text entered, in particular if it contains personal data.
----------------------------
Annex 2. Security specification
General obligations
The Processor undertakes to take all necessary technical and organisational security measures as required by the General Data Protection Regulation (GDPR), in particular Article 32 GDPR.
These measures are designed to guarantee a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, as well as the nature, scope, context and purposes of the processing and the risks to the rights and freedoms of natural persons.
Compliance with ISO/IEC 27001:2022
In addition to the GDPR requirements, the Processor acts in accordance with the ISO/IEC 27001:2022 standard for information security management.
The Processor’s Information Security Management System (ISMS) includes at least the following controls:
- Risk management – Regular identification, evaluation and treatment of information security risks.
- Security policy – Maintenance of a formal and documented information security policy.
- Organisation of information security – Established governance structure with roles and responsibilities.
- Human resource security – Employees are trained and contractually bound to confidentiality.
- Asset management – Identification, classification and protection of information assets.
- Access control – Least-privilege principle; periodic review of access rights.
- Cryptography – Application of appropriate encryption techniques for the confidentiality and integrity of information.
- Physical and environmental security – Security of facilities and equipment.
- Operational security – Secure execution of processes and maintenance of log files.
- Communications security – Protection of information in networks and communication services.
- System development and maintenance – Integration of security into the design and development of IT systems.
- Supplier relationships – Contractual safeguards and oversight of sub-processors.
- Incident management – Rapid detection, reporting and follow-up of information security incidents.
- Continuity management – Protection of the continuity of business and IT processes.
- Compliance – Regular assessment against statutory, regulatory and contractual obligations.
Specific additional measures
- Encryption – TLS encryption during transport and encryption at rest for databases, temporary buffers and back-ups; periodic review of key management.
- Logging & monitoring – Audit logging of all relevant processing operations involving personal data, including entries in free-text fields, temporary storage, export and deletion; log data is stored securely and reviewed periodically by the Security Officer.
- Data lifecycle management – Automatic retention timers and automated deletion of temporary data after completion of the process; periodic restore tests of back-ups.
- Access control (operational) – Separation of development, test and production environments; administrator accounts are logged and reviewed at least annually.
- DLP alerts – UI warnings and optional pattern filters discourage the entry of sensitive or special categories of personal data via free-text fields.
- Change management – Changes to forms or field structures are subject to a formal change process, including a data protection impact assessment (DPIA).
----------------------------
Annex 3. Sub-processor Specification
The Processor may make use of the following categories and parties of sub-processors in the Processing:
Bird
Processed data: First and last name; email address; content data of emails.
Purpose of processing: Messagebird is used for sending email communications. This includes transactional emails and other forms of communication via email.
Processing activities: Sending emails to users on the basis of the lists provided; processing response data such as email open and click-through rates; maintaining email lists and unsubscribe requests.
Location of processing: The data is processed in data centres of SparkPost, located in Europe.
Security measures: Messagebird implements industry-standard security protocols and encryption techniques to safeguard the integrity and confidentiality of data.
Duration of processing: The data is processed for as long as necessary to perform the email services, or until a user unsubscribes or requests the deletion of his or her data.
Compliance with laws and regulations: Messagebird complies with the GDPR and other relevant privacy laws for the protection of personal data.
Amazon AWS
Processed data: Names and email addresses of users; profile pictures of users; additional fields added by the controller, which may vary depending on user requirements; progress and scores of users in course material and assessments; log files recording changes in the database; files stored on AWS S3, including any user data or course materials.
Purpose of processing: AWS is used for hosting and managing this data, with the aim of providing a scalable, reliable and secure infrastructure for our services.
Processing activities: Storage and management of personal data and user profiles; hosting of educational content and tracking of user performance; maintenance and management of log files for security and monitoring; storage and management of files on AWS S3.
Location of processing: The data is processed and stored in AWS data centres located in Frankfurt, Germany. For failover purposes, the database and file storage are replicated to AWS data centres in Dublin, Ireland. All processing remains within the EEA.
Security measures: AWS implements extensive security measures including network security, encryption, access control and regular security audits, and complies with relevant industry standards and certifications such as ISO 27001, SOC 1 and SOC 2.
Duration of processing: Data is stored and processed for as long as necessary to provide the services.
Compliance with laws and regulations: AWS complies with the GDPR and other relevant European and international privacy laws for the protection of personal data.
https://aws.amazon.com/compliance/gdpr-center/
OpenAI (AI functionality within the course module builder)
Processed data: Text input entered into the AI module by the user or controller, including any personal data contained therein. Pluvo does not send or collect any other identifying data (such as user IDs, email addresses or IP addresses) beyond the technical transmission.
Purpose of processing: Supporting the AI functionality within the course module builder in the Pluvo platform, as well as automatically translating course material into other languages. In this context, text entered by the controller ("prompt") may be temporarily forwarded to the OpenAI API environment in order to generate draft course material or to produce translations of existing course material.
Processing activities: Processing of textual input, computation of the model response and return of generated text to the Pluvo environment.
Location of processing: Processing takes place within data centres managed by OpenAI. The contracting party for the EEA is OpenAI Ireland Limited; transfers to OpenAI entities outside the EEA take place on the basis of standard contractual clauses (SCCs).
Security measures: Encryption in transit (TLS 1.2 or higher), authentication via secured API keys, limitation of log retention to the functional duration of the session.
Duration of processing: No storage of this data by OpenAI takes place beyond the duration of the API session, in accordance with its data processing policy.
Responsibility of the controller: The controller is responsible for the nature and lawfulness of the content entered. Personal data or other sensitive information may only be entered into the AI module if a valid legal basis exists for doing so under the GDPR. Pluvo has no access to, nor does it carry out any assessment of, the content of the prompts entered.
Compliance with laws and regulations: OpenAI acts as a sub-processor of Pluvo within the meaning of Article 28 GDPR. Pluvo has concluded an agreement with OpenAI which stipulates that the processing complies with the applicable European data protection legislation.
https://openai.com/policies/data-processing-addendum/
Crisp
Processed data: Name, email address, the content of chat messages and technical metadata (such as browser and device data) of users who make contact via the chat.
Purpose of processing: Crisp is used for the in-app chat and support functionality, enabling users and administrators to communicate directly with Pluvo.
Processing activities: Receiving, storing and displaying chat messages and associated contact details; managing the conversation history and support requests.
Location of processing: The data is processed in data centres within the European Union (France).
Security measures: Crisp applies encryption in transit (TLS) and at rest, with access restrictions and industry-standard security measures.
Duration of processing: The data is processed for as long as necessary for the support and communication service, or until a user requests deletion.
Compliance with laws and regulations: Crisp complies with the GDPR. A data processing agreement (DPA) has been concluded with Crisp.
https://crisp.chat/en/privacy/
Sentry
Processed data: Technical error messages, stack traces and application diagnostics, including a user ID in order to link errors to a session. IP addresses are not stored. Other identifying data (such as names and email addresses) is masked and minimised where possible via server-side data scrubbing.
Purpose of processing: Sentry is used for error and performance monitoring, in order to monitor the stability, availability and security of the platform and to investigate incidents.
Processing activities: Collecting, aggregating and displaying error reports and technical diagnostics for the purpose of detecting and resolving problems.
Location of processing: The data is processed in Sentry's EU region (data centre in Frankfurt, Germany). Transfer outside the EEA is not contractually excluded; for such transfers, the EU-US Data Privacy Framework and standard contractual clauses apply as safeguards.
Security measures: Encryption in transit (TLS 1.2 or higher); server-side data scrubbing with standard filters that exclude passwords and credit card data; IP addresses are not stored; access restricted to authorised developers. Sentry is ISO/IEC 27001 and SOC 2 certified.
Duration of processing: Error data is retained in accordance with the retention period configured in Sentry.
Compliance with laws and regulations: Sentry complies with the GDPR. A data processing agreement has been concluded with Sentry (Data Processing Amendment v5.1.0).
Bunny.net
Processed data: The video files uploaded within the academy, including the persons who are recognisable on screen or audible in them, and the technical data required to deliver a video to a viewer, including the IP address and browser data. No account data, names, email addresses, results or other academy data are provided to this party.
Purpose of processing: Bunny.net is used for storing and delivering video material within the academy, so that users can play videos quickly and reliably.
Processing activities: Storing, transcoding and delivering video files via a content delivery network, and keeping technical playback and performance data for the purpose of the availability of the service.
Location of processing: The video files are stored in Europe. For delivery, only the EU pull zones of bunny.net are active, as a result of which playback via edge locations also takes place within the EEA. No transfer outside the EEA takes place.
Security measures: Encryption in transit (TLS); access to the management panel restricted to authorised administrators with multi-factor authentication. Bunny.net is ISO/IEC 27001 certified.
Duration of processing: Videos remain available for as long as the controller keeps them in the academy. If the controller deletes a video, the file is deleted at bunny.net. After termination of the agreement, the deletion period set out in Article 10 of this data processing agreement applies.
Compliance with laws and regulations: Bunny.net complies with the GDPR. A data processing agreement has been concluded with bunny.net (Data Processing Agreement v2).
Rights and obligations
These provisions apply to all sub-processors referred to above.
Audit rights: We reserve the right to inspect compliance with regard to data security and privacy.
Notification of data breaches: The sub-processor must notify us immediately of any data breaches or security incidents that occur.
Sub-processors: The sub-processor is obliged to provide clarity regarding any additional sub-processors, and must confirm whether the data processing takes place within the European Union.