Data processing agreement

• Processor: Boldcaster B.V.
• Controller: the client that creates an account and/or takes out a subscription.
• Personal data, Data subject, Data breach, Sub-processor: as defined in Article 4 GDPR.
• Partner: an organisation that uses the Boldcaster service to support its own clients and manages those clients' environments.

The Processor processes personal data on behalf of the Controller in the context of the Boldcaster service. The term runs parallel to the main agreement. Obligations that by their nature continue (such as confidentiality) remain in force after termination.

Storage, structuring, analysis, AI processing and reporting for the Boldcaster features (strategy, planning, finance, people, processes).

Account data, contact details of team members and clients of the Controller, financial data, KPI data and strategic data as entered into the platform by the Controller.

Employees and management team members of the Controller, contact persons and, where entered by the Controller, its clients.

The Processor processes personal data solely on the documented instructions of the Controller and imposes confidentiality on everyone who has access.

Technical and organisational measures in line with art. 32 GDPR: TLS 1.3 in transit, AES-256 at rest, Row Level Security, MFA for admin access, audit logs, encrypted backups and Coolify-managed deployments via private GitHub repositories.

As administrator of the platform, the Processor has access to the Controller's environment. That access is used solely for support, troubleshooting and security, and is recorded in the audit logs.

The Processor does not use the personal data for its own purposes. For product improvement and benchmarks, only data is used that has been aggregated or anonymised to such an extent that it can no longer be traced back to the Controller or to a data subject.

The Processor may engage sub-processors provided they are listed in Appendix 2. For any intended addition, the Processor informs the Controller in advance; the Controller can object within 30 days.

With each sub-processor, the same or stricter obligations are contractually agreed as in this Agreement.

If the service is obtained through a Partner, a chain arises. The Controller determines the purpose and means of the processing and remains the controller. The Partner processes the Controller's data in order to advise it and is therefore itself a processor. Boldcaster provides the platform in which this happens and acts as processor and sub-processor respectively. The parties listed in Appendix 2 are sub-processors of Boldcaster.

This Agreement applies directly between the Processor and the Controller, also where the Partner pays for the subscription and administers the environment. In addition, the Controller concludes its own data processing agreement with its Partner. The Controller hereby grants the Partner a general authorization to engage Boldcaster as a sub-processor; this Agreement and Appendix 2 constitute the information provided in advance about that.

Within the Controller's environment the Partner has administrator rights and can see all personal data recorded there, including data from performance and appraisal conversations. That access is limited to the organisations in the Partner's portfolio and is enforced at database level (row level security), not only in the application. Clients of a Partner cannot see each other's data and the Partner does not appear as a team member in the Controller's environment. The Partner cannot change the subscription, the billing details or the ownership of the environment.

The Controller informs its team members about the Partner's access. On request, the Processor makes standard wording available for this.

The Processor addresses a data breach notification and a data subject request to the Controller, and simultaneously to the Partner insofar as the Partner administers the environment. The 72-hour period in the article on data breaches applies in full. Notification to the Dutch Data Protection Authority and to data subjects remains the responsibility of the Controller. An export of the Controller's data is provided only to the Controller itself; a request to that effect from the Partner is carried out by the Processor only after confirmation by the Controller.

If the relationship between the Controller and the Partner ends, the Processor withdraws the Partner's access: immediately at the Controller's request, and otherwise within five working days after the Processor becomes aware of the termination. The Controller's data remains unchanged and available in its own environment. The Partner is itself liable for careless handling of the Controller's data.

The Processor reports a data breach to the Controller within 72 hours of discovery, with all information needed to notify the Dutch Data Protection Authority and data subjects.

The Processor supports the Controller in fulfilling GDPR obligations (access, rectification, erasure, data portability) within a reasonable period and no later than 14 days after the request.

The AI features of Boldcaster run on Mistral AI, a provider based in France that processes on servers within the European Union. No US provider is involved in analysing strategy, numbers, goals or personnel data.

The use of client data to train AI models is disabled in the account settings at Mistral and is contractually excluded. The Processor does not train any models on client data itself and does not provide client data to third parties for that purpose.

Input is retained by the AI provider for a maximum of thirty days for abuse detection and then deleted. The Processor has no access to other clients' conversations at this provider.

When drawing up reports about team members, names are replaced by a neutral label before sending. The AI provider therefore receives no identifiable assessments of individual team members. The translation back to the real name only happens within the application.

AI connection at the Controller's request. The Controller can enable, per organisation, a connection that lets authorized users operate Boldcaster from an AI application of their choice, such as Claude, ChatGPT or Vibe. This connection is off by default. When it is on, the Processor provides data to that application only at the request of an authorized user, within that user's rights and within the parts the Controller has enabled.

The provider of such an AI application is not a sub-processor of the Processor. The Controller or the user chooses and contracts that provider, and processing by that provider falls outside this agreement, including where it takes place outside the European Economic Area. The Processor records every request made through the connection in a log the Controller can view. A user and the Controller can revoke access at any time.

No transfer of personal data takes place outside the European Economic Area, except to countries with an adequacy decision or via Standard Contractual Clauses (SCCs). Any transfers are recorded in Appendix 3.

The Controller is entitled to one audit per year, or to access an independent audit report, after reasonable prior notice of at least 30 days. Costs are borne by the Controller, unless the audit reveals a material shortcoming.

Liability is limited in accordance with Boldcaster's Terms and Conditions, except for damage caused by gross negligence or intent of the Processor.

All personal data is deleted or returned within 30 days after the end of the agreement (at the Controller's choice), including copies in backups. The Processor confirms deletion in writing.

This Agreement is governed by Dutch law. Disputes are submitted to the Amsterdam District Court.