Data processing agreement

Draft. This data processing agreement is part of the terms and conditions of Beamcore and is still being legally reviewed.

1. Roles

You, the customer, are the controller of the personal data you put into Beamcore. Beamcore is the processor: we only process that data to deliver the service to you and only according to your instructions, as laid down in this agreement and the settings you choose in Beamcore.

2. Which data and of whom

• Employees: name, contact details, job title and, if you use those modules, rosters, hours, leave, contracts, cost rates, certificates and documents. Citizen service numbers and IBANs are stored encrypted.
• Clients and contacts: name, company details, email, phone, addresses and the quotes and invoices you send them.
• Project data: drawings, models, files, photos, messages and planning, which may also contain personal data.
• Users: login details, roles and log files.

Do not put special categories of personal data, such as health data, into Beamcore. The service is not intended for that.

3. Confidentiality

Everyone at Beamcore with access to your data is bound by confidentiality. Beamcore staff only look into your account when needed for support, and this is logged.

4. Security

We take appropriate technical and organisational measures, such as encryption, role-based access, strict separation between companies, daily backups and logging. The measures are on the Security page.

5. Sub-processors

You consent to the sub-processors on the Sub-processors page. We announce a new sub-processor at least 30 days in advance; you can object. We impose the same obligations on sub-processors as in this agreement.

6. Data outside the EU

Beamcore runs in Amsterdam. Data only leaves the EU via the sub-processors listed for that, with appropriate safeguards such as the EU-US Data Privacy Framework or the standard contractual clauses.

7. AI features

When you use an AI feature, only the text or document you have processed goes to Anthropic (Claude). That data is not used to train AI models. You check the result.

8. Help with rights and obligations

We reasonably assist you with requests from data subjects (access, correction, deletion, portability), with a DPIA and with questions from the supervisory authority. Much of this you can do yourself in Beamcore, such as changing or exporting data.

9. Data breaches

If we discover a data breach affecting your data, we report it without undue delay to the administrator of your account, with what we know about its nature, consequences and the measures taken. You decide whether the breach must be reported to the Dutch Data Protection Authority (within 72 hours) and to the data subjects.

10. Audit

You may check whether we comply with this agreement. We first do so with information and statements we provide; an audit can be arranged by agreement, at your expense unless a shortcoming is found.

11. End

Before the agreement ends or you have your account deleted, you download your invoices and other data. After that we delete your data; Beamcore does not keep it for you. Backups are overwritten within their normal retention period. You keep your invoices yourself for the statutory retention period.

12. Liability

The arrangements on liability in the terms and conditions apply.

This is a draft. Have the final text reviewed by a legal advisor before launch.