Data processing agreement Tegnest

This is the English version of our Dutch text. Both versions apply equally. If they differ, the text most favourable to you applies.

Annex to the general terms and conditions of Tegnest, version 2026-10-14.4. These arrangements follow article 28 of the GDPR (AVG).

Parties

You (the customer): the controller. You determine why your website receives personal data.
Dario Albers (sole proprietorship, trade name Tegnest), Vlierstraat 196, 7544 GJ Enschede, KvK (Dutch Chamber of Commerce) 42167593, hallo@tegnest.com: the processor. In this agreement, this is referred to as "we".

You accept this agreement when you accept the general terms and conditions. If you already upload photos or other material before you order, these arrangements apply from that first upload. You then accept them before that upload.

1. What is this about?

This agreement only applies to personal data that we process for you via your website, including in photos and other material you supply, from your first upload. It does not apply to data about you as a customer (your account, payments, invoices, your domain registration and the business details for the AI). We are ourselves responsible for that data. This is set out in our privacy statement (https://tegnest.com/privacy).

2. Which data, of whom and for what?

What we do	Hosting and securing your website. Processing photos you upload (rotating, resizing, removing all metadata), storing them and showing them on your website; a person on our team looks at every new website, including your photos, within one working day after it goes online. Forwarding messages from your contact form to you by email. Preventing abuse of your forms. Counting visitors (numbers only; for that we make temporary pseudonymised codes per day, only the final totals are anonymous). Counting what your website brings you: how many messages, requests and appointments come in per day (numbers only). With the request form and inbox add-on (article 4.5 of the terms): storing requests from your request form in the inbox in your account, letting you know about them by email, sending the requester an acknowledgement of receipt (if you switch this on), and deleting the requests after your retention period. With online appointments (online appointments add-on): storing appointments that visitors make on your website, and appointments you enter yourself, in the calendar in your account; emailing the visitor a confirmation with a link to cancel, and (if you switch this on) a reminder the day before; letting you know by email about new and cancelled appointments; emailing the visitor when you confirm or cancel an appointment; and deleting the appointments after your retention period. Forwarding email to your domain to the inbox you choose, without storing the mail. With the deposit (article 4.6 of the terms, as soon as it is available to buy): for an appointment with a deposit, creating the payment on your own Mollie account, reading its status at Mollie, confirming the appointment or letting it lapse on that basis, refunding the deposit in the cases of article 4.6, and emailing the visitor and you about this.
Purpose	Only to provide your website and the related services, as set out in the general terms and conditions.
Of whom	People who are recognisable in the photos you upload (for example your employees or customers). Visitors to your website, people who fill in your contact form or request form, people who make an appointment online or whom you put in your calendar, and people who send email to an address on your domain that you have forwarded.
Which data	Contact form: name, email address or telephone number, the message (and whatever someone puts in it themselves). The IP address only as a pseudonymised code (hashed with a secret key) in a counter; such a code remains personal data. Request form (add-on): the answers to the questions you put in your form. You choose these from a fixed list of types: short and long text, email address, telephone number, date, time, number, choices, tick box, address and postcode. Usually these are name, contact details, an address and the details of the request. In addition: the status, the notes you add, when emails about it were sent, and if our automated check found something suspicious in the text, the reason for that (not the text itself). The IP address only hashed in a counter, as with the contact form. Online appointments (online appointments add-on): name, email address, telephone number (if someone fills it in), the chosen service, day and time, a comment, the status (requested, confirmed, cancelled, no-show, done), the notes you add, when emails about it were sent, the reason if our automated check found something suspicious in the comment (not the text itself), and a check code (hash) of the management link from the confirmation. The IP address only hashed in a counter. Server logs: IP address, browser, time and page (at Vercel). Email forwarding: the emails sent to your domain (sender, recipients, subject, content and attachments) go via the forwarding service to your inbox. Counting visitors: numbers of visitors per day and pages visited per day, without cookies and without storing the IP address. We count on our server, from the request for a page that the visitor's browser sends anyway; no script runs in the browser for this and we read or store nothing on the visitor's device. With Do Not Track or Global Privacy Control switched on, we do not count. To count unique visitors per day, we make a code from the IP address and the browser data, with a secret key that changes every day, which is only kept in a counter until the end of the day (and in a counter against abuse, for one hour). Counting results: per day the number of messages from the contact form that we emailed to you, the number of stored requests and the number of appointments that the visitor confirmed (or for which the deposit came in). Numbers only: not who, not what. Until 14 October 2026 we also counted how often your telephone number, WhatsApp link, email address or directions link was tapped (numbers only); those numbers stay until your website is deleted, new ones are no longer counted. Photos you upload: what is in them, and that can be people, their home or their car. When processing, we remove all metadata (EXIF, including the location where the photo was taken) and delete the original. We store resized versions, the dimensions, a checksum (hash) and the description (alt text) you fill in. When uploading, you declare that you have the rights to the photos and that there are no recognisable people in them without their consent. Your photos are not sent to an AI. Deposit (add-on): with the appointment, Mollie's payment reference, the amount, whether and when payment and refund took place, and the text about the deposit that the visitor saw beforehand. No card or bank details: the visitor pays on Mollie's payment page.
Special categories of data	Not intended. Do not ask for health data, BSN (citizen service number) or similar data on your website. The request form refuses fields that ask for these (health, religion, ethnic origin, sexual orientation, political preference, criminal law, BSN and other identification numbers, passwords and codes, bank and card details). If someone writes such data themselves in a free text field, it will be in your inbox; delete the request if you do not need it. A photo can also show such data (for example something about someone's health or religion); do not upload such photos.
How long	We do not store messages from the contact form, and we do not put them in logs. We send them by email to the address you set, via Resend. We do store requests from the request form, in our database, so that you can handle them in your inbox. We keep a request until 12 months after the last activity (receipt, status change or note), or 3 or 6 months if you choose so in your account. After that we delete it automatically. You can also delete a request yourself earlier. If you switch off the add-on, we no longer accept new requests; the requests that are already there remain until your retention period expires, so that you can still view, download and delete them. We do not put the content in logs. The email to you contains a summary (at most 8 answers) and in the subject the name, email address or telephone number of the requester; if you reply, the reply goes to the requester; the acknowledgement of receipt to the requester contains nothing of what they filled in. We also store appointments, in your calendar. We keep an appointment until 12 months after the date of the appointment, or 3 or 6 months if you choose so in your account. After that we delete it automatically. You can also delete an appointment yourself earlier. The confirmation and the reminder to the visitor only mention your business, the service, the day and time (and your address and telephone number if they are on your website), nothing of what the visitor typed themselves. The email to you mentions the appointment with the visitor's name, telephone number and email address. Resend keeps sent email up to 30 days. Counters with the hashed IP address: at most 1 hour (the per-website counter of the request form and of online appointments: 1 day; the daily code for counting visitors: until the end of the day), then deleted. Server logs: 1 day (Vercel Pro). Forwarded email we do not store in a mailbox. The forwarding service (Cloudflare) only holds the mail until it has been delivered. Our forwarding code only logs the address, what happened to it and the size, for a few days, to resolve faults (not the content). Cloudflare may also keep data for the delivery itself, according to its own periods. Visitor numbers and the numbers from counting results: as long as your website exists; they are deleted with your website (article 11). If you delete a request or appointment yourself, or the retention period expires, only the number remains. Photos: we delete the original directly after processing (usually within a minute); an upload that was never completed, after 24 hours. The resized versions remain until you delete them yourself, and at the latest until your website is deleted (article 11). They are in public storage with a long, unguessable address: anyone who has that address can see the photo, also before your website is online. After deletion that address no longer works. Visitors who already saw the photo may still have it in the cache of their own browser for some time (up to a year); we cannot erase that. The recorded version of your website at your order (proof of what you approved) refers to the photo but does not contain it: after deletion the photo is missing there. Everything else: until deletion (article 11). We keep data about a deposit with the appointment and delete it together with that appointment. For your own records, the payments are in your Mollie account.

3. Your instructions

We only process the data for the purposes above and in accordance with your instructions. The settings you choose in your account are also instructions: for example switching the contact form on or off, the questions in your request form, the retention period of requests, the email address for notifications and the acknowledgement of receipt, and for appointments your services, times, locations and closed days, the retention period of appointments, whether appointments are confirmed immediately, the cancellation period and the reminder.
If we are required by law to do something else, we let you know in advance, unless the law prohibits this.
If we consider an instruction to be in breach of the GDPR, we say so immediately.

4. Confidentiality

Only those who need the data for their work can access it. Everyone who works for us has a duty of confidentiality.

5. Security

We take appropriate measures (article 32 GDPR), including:

encrypted connections (https/TLS) for your website and our platform;
access only with a personal account, logging in with a one-time code by email, and as few people with access as possible; administrators log in with their Google account (with two-step verification at Google) or with a code by email, their login expires after 12 hours and every administrator login is recorded in the log;
login credentials and keys only on the server, never in the browser;
databases and storage in the EU where possible;
updates and backups (the database can be restored to any moment in the last 7 days (point-in-time recovery at Neon), the main database is protected against deletion, and we practise restoring with a recovery test);
a log of changes in the platform.

6. Sub-processors

You give us general authorisation to engage the sub-processors listed in the annex.
If a new sub-processor is added, or we replace one, we announce this at least 30 days in advance by email. If you do not agree, you can object. If we cannot find a solution together, you can cancel the hosting free of charge, with effect before the new sub-processor starts. You then get the money paid in advance back for the days that remain (per day).
We impose the same obligations on sub-processors as set out in this agreement. We remain responsible to you for them.

7. Data outside the EU

Some sub-processors are American companies. We choose an EU region where possible. If data nevertheless goes outside the EEA, this only happens on a valid legal basis, such as the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission. This is stated per sub-processor in the annex.

8. Assistance to you

If someone asks you for access to, correction or deletion of their data, we help you with that. You can search, view, export (as a CSV file) and delete requests yourself in your account. You can view, export (as a CSV file) and delete appointments in your calendar. You can delete photos in your account. If such a request reaches us, we forward it to you.
We also help you with your other obligations under articles 32 up to and including 36 GDPR: security, notifying a personal data breach to the supervisory authority and to the people concerned, a DPIA and a prior consultation of the supervisory authority. If you have questions from the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority) (or another supervisory authority), we give you the information we have.
If that assistance takes more than a reasonable amount of time, we first discuss the costs with you.

9. Personal data breaches

If we discover a personal data breach affecting your data, we report it without undue delay, and no later than 48 hours after we discovered it. Those 48 hours are an outer limit, not a waiting period.
We then tell you what happened, which data and how many people are affected, what the consequences may be and what we are doing about it. If we do not yet know everything, we send the rest as soon as possible.
You decide whether you report the breach to the Autoriteit Persoonsgegevens or to the data subjects. We do not do this ourselves for you, unless you ask us to.

10. Audits

We give you all the information needed to demonstrate that we comply with article 28 GDPR and this agreement.
You may check whether we comply, yourself or via an auditor you appoint, including by means of an inspection. Whoever carries out the check keeps confidential what they see.
For an ordinary audit, we agree a reasonable period together. In the case of a personal data breach, an indication that we are not complying with this agreement, or a request from a supervisory authority, there is no fixed limit per year and no waiting period.
You pay the costs of your own auditor, unless the audit shows that we have seriously breached this agreement.

11. End

This agreement runs as long as we process data for you.
After the end, you choose: do you get all personal data we processed for you back, or do we delete it? You may let us know this by email at any time, also earlier.
If you choose nothing, this counts as your instruction: you can download your requests and appointments yourself as CSV in your account, until 30 days after the end of the hosting (after that your website is archived); after that, until deletion, you can request an export of your website and of your requests and appointments (as CSV) from us; as long as we hold the data, you can get it back. 90 days after your website has been archived, we delete the data, including all requests, appointments, your forms and your services and times for appointments. If you want us to delete earlier, or to get everything back earlier, email us; we will then do so.
They do not remain with us for a retention obligation: you have that obligation, and the export is for that purpose. Copies and backups are then overwritten in their normal cycle, within 7 days. Deleted data remains for at most 7 days in the restore timeline of the database (Neon point-in-time restore).
We only keep longer what a specific statutory retention obligation of ours requires.

12. Liability and what prevails

For liability between you and us, the rules from the general terms and conditions apply: article 13 if you are a business customer, and article B6 (the rules of the law) if you are a consumer. Nothing in this agreement or in the terms limits the rights of the people concerned, such as their right to compensation (article 82 GDPR). If it concerns personal data and the terms contradict this agreement, this agreement prevails.

Annex — sub-processors and other parties

Role: SV = sub-processor for your website data. V = processor for our own customer administration, not for your website data. ZV = independent controller.

Party	What	Role	Where / transfer
Vercel Inc.	Hosting of websites and platform, server logs. Storage of the photos you upload (Vercel Blob, public storage `platform-media`)	SV	US company; functions in Frankfurt (fra1), network worldwide; photo storage in Frankfurt (fra1), delivered via the worldwide network; Vercel’s DPF certification, and the SCCs in Vercel’s data processing agreement
Neon (Databricks)	Database: your website, requests from your request form (add-on; separated per customer), appointments (online appointments add-on; separated per customer), counters with hashed IP addresses, anonymous visitor numbers and numbers per day of messages, requests and appointments (and the taps on your contact details from before 14 October 2026). No messages from the contact form.	SV	EU (Frankfurt, aws-eu-central-1); US parent company: SCCs in Neon’s data processing agreement; the data is stored in Frankfurt (aws-eu-central-1)
Resend	Emailing messages from the contact form and notifications of new requests (with a summary) to your inbox (reply-to address = the visitor's email address, if they filled it in); acknowledgements of receipt to requesters; for appointments, the confirmation, reminder and status emails to the visitor and the notifications to you	SV	EU (Ireland, eu-west-1). US company.; SCCs in Resend’s data processing agreement
Cloudflare, Inc.	The same emails as above, when they are sent from your website's address (…tegnestsites.com): messages from the contact form, notifications and confirmations of requests and appointments.	SV	US company, worldwide network; Cloudflare’s DPF certification, and the SCCs in Cloudflare’s data processing agreement
Cloudflare, Inc. (forwarding)	Forwarding email to your domain to your inbox: receiving (Email Routing), forwarding as a new message (our Worker and Email Sending) and the DNS of your domain. The content is not stored; the Worker only logs the address, what happened to it and the size, for a few days, for faults	SV	US company, worldwide network; Cloudflare’s DPF certification, and the SCCs in Cloudflare’s data processing agreement
Openprovider (Hosting Concepts B.V.)	Registration of your domain name (the DNS is at Cloudflare)	V (holder data also goes to SIDN, ZV)	Netherlands
Mollie B.V.	Payments and direct debit to us. Deposits (add-on, article 4.6): the payment runs on your own Mollie account; for this, Mollie is your payment service provider and processes your customers' payment data as an independent controller, not as our sub-processor. We read the status of those payments for you via the connection.	ZV	Netherlands
Moneybird B.V.	Invoices and accounting	V	Netherlands
OpenRouter + model providers (currently Google Gemini 3.7 Flash and OpenAI GPT-6 Luna)	AI writes and adjusts website texts, and suggests questions for your request form. Only business details you fill in, your own adjustment requests and your description of the form. With "zero data retention" and without training. No data of your visitors, no requests or appointments, and no photos.	V	US; no EU pinning; SCCs in OpenRouter’s data processing agreement