Data processing agreement

Version: 2 November 2026

This data processing agreement forms part of the Terms of Use for Places Builder Online.

1. Parties

1. Customer: the organisation that creates or uses a Places Builder Online workspace and determines the purposes and means of processing its customer content (the Controller).
2. Provider: ralpheckhard.com, a sole proprietorship operated by Ralph Eckhard, Westerwerf 3F, 1911 JA Uitgeest, the Netherlands, Chamber of Commerce number 78690277 and VAT number NL003372112B37 (the Processor).

The workspace owner confirms that they are authorised to accept this agreement on behalf of the Controller.

2. Scope and duration

This agreement applies when the Processor handles personal data contained in floor plans, office data, room information or other materials placed in the Controller’s workspace.

Processing begins when the Controller first places customer content in the service and continues until that content has been deleted in accordance with this agreement.

The Processor is a separate controller for account, membership and security information processed for its own service-administration and security purposes. That processing is described in the Places Builder Online privacy statement and is outside the processing performed on the Controller’s behalf under this agreement.

3. Processing instructions

The Processor will process personal data only:

• on the Controller’s documented instructions;
• as necessary to host the workspace, process source files, produce IMDF packages, make those packages available to the Controller, secure the service and delete the data;
• as set out in this agreement and the Terms of Use; or
• where processing is required by applicable law, in which case the Processor will inform the Controller before processing unless the law prohibits that notice.

Use of the service functions and configuration by authorised workspace members constitutes a documented instruction within the scope described in Appendix 1.

If the Processor reasonably believes an instruction infringes applicable data-protection law, it will inform the Controller and may suspend the affected processing while the parties address the issue.

4. Controller responsibilities

The Controller is responsible for:

• determining a valid basis and purpose for the processing;
• ensuring that uploaded content is relevant and lawful;
• providing required information to affected individuals;
• managing workspace membership and removing access that is no longer required;
• responding to individual-rights requests and regulator enquiries; and
• not placing personal data, credentials, confidential floor plans or security-incident details in public GitHub issues.

5. Confidentiality

The Processor will ensure that anyone authorised to process customer personal data is bound by confidentiality obligations and receives access only where needed for the service, security or support.

6. Security

The Processor will maintain the measures described in Appendix 2, taking account of the pilot’s nature and the information processed. The current measures include:

• sign-in through Microsoft Entra;
• logical separation of workspaces by organisation;
• automated tests addressing organisation separation;
• managed identities rather than shared storage keys;
• secrets held in Azure Key Vault;
• encryption in transit;
• Azure storage soft delete and versioning; and
• monitoring with alerts.

The Controller acknowledges that the service is a free pilot without a service level. This does not remove the Processor’s obligation to maintain the measures stated in this agreement.

7. Personal-data breaches

The Processor will notify the Controller of a confirmed personal-data breach affecting the Controller’s customer content without undue delay and, where reasonably possible, within 48 hours after becoming aware of it.

The Processor will not delay the initial notification solely because all facts are not yet available. Information may be supplied in stages. To the extent known, the notice will describe:

• the nature of the incident;
• the affected information and workspaces;
• the likely consequences;
• measures taken or proposed to contain and remedy the incident; and
• a contact point for follow-up.

The Processor will reasonably assist the Controller with its assessment, notifications and communications. The Controller remains responsible for deciding whether it must notify a supervisory authority or affected individuals.

8. Individual-rights requests

If the Processor receives a request relating to customer content, it will refer the requester to the Controller where appropriate and inform the Controller unless legally prohibited.

Taking account of the nature of the processing and available service functions, the Processor will reasonably assist the Controller in responding to requests concerning access, correction, deletion, restriction, objection and data portability.

9. Other compliance assistance

Taking account of the nature of the processing and the information available to it, the Processor will reasonably assist the Controller with security assessments, personal-data breach obligations, data-protection impact assessments and prior consultation relating to the service.

10. Subprocessors

The Controller gives general authorisation for the Processor to use the subprocessors listed in Appendix 3.

The Processor will announce an intended addition or replacement of a subprocessor at least 30 days in advance where reasonably practicable. The Controller may object during that period on reasonable data-protection grounds. The parties will attempt to resolve the objection. If they cannot, the Controller may stop using the affected service before the change takes effect and request deletion.

A shorter notice period may be used where an urgent replacement is reasonably necessary for security, legal compliance or continued operation. The Processor will provide notice as soon as reasonably practicable.

The Processor will impose appropriate data-protection obligations on each subprocessor and remains responsible for the performance of the subprocessor’s processing obligations to the extent required by the agreement applicable between the Processor and that subprocessor.

11. Location and international transfers

The hosted application and customer content use Microsoft Azure in the West Europe region. No transfer of customer content outside the European Economic Area is intended.

The public website uses Azure Static Web Apps and may be delivered through Microsoft’s global network. The Processor will review transfer arrangements if its configuration, subprocessors or support arrangements change.

The Processor will not intentionally transfer customer personal data outside the European Economic Area without an applicable transfer mechanism and notice to the Controller.

12. Return and deletion

The Controller may download generated IMDF packages while the workspace is active.

On a valid deletion request or when the Controller stops using the service, the Processor will remove the active workspace and customer content within 14 days. Storage safeguards may keep deleted files recoverable for up to a further 14 days. Complete deletion may therefore take up to 28 days.

During a recovery period, deleted data will not be used for ordinary service purposes. The Processor may retain information for longer only where required by applicable law, in which case it will remain protected and will not be used for another purpose.

On reasonable request, the Processor will confirm completion of the deletion process.

13. Information and audit

The Processor will make available information reasonably necessary to demonstrate compliance with this agreement. The Controller may first request written information and available documentation.

If that information is reasonably insufficient, the Controller may conduct or commission an audit concerning the processing covered by this agreement, subject to reasonable advance notice, confidentiality, security requirements and measures to avoid disruption or exposure of another organisation’s information.

Unless an audit identifies a material breach by the Processor, the Controller bears its own audit costs and the Processor’s reasonable costs of providing assistance beyond ordinary documentation.

14. Changes and termination

Materially adverse changes to this agreement will be announced at least 30 days in advance. Changes reasonably required for urgent security, abuse prevention, legal compliance or correction of an evident error may take effect sooner, with an explanation as soon as reasonably practicable.

This agreement ends after the Processor has completed deletion under Section 12. Provisions that by their nature concern confidentiality, deletion, audit or liability continue to apply as necessary after termination.

15. Liability and precedence

The liability provisions in the Terms of Use apply to this agreement to the fullest extent permitted by applicable law. The Processor’s substantive duties under this agreement remain in force notwithstanding that liability exclusion.

If this agreement conflicts with the Terms of Use on the handling of personal data processed on the Controller’s behalf, this agreement prevails for that conflict.

16. Governing law and disputes

This agreement is governed by Dutch law. The dispute provision in the Terms of Use applies.

Appendix 1 — Processing details

Appendix 2 — Technical and organisational measures

1. Microsoft Entra authentication for service access.
2. Workspace access linked to Microsoft tenant and user object identifiers.
3. A maximum of 25 members per workspace.
4. Logical separation of organisations in the application.
5. Automated tests addressing organisation separation.
6. Managed identities and no shared storage keys for application access.
7. Secrets stored in Azure Key Vault.
8. Encryption in transit.
9. Azure Storage soft delete and versioning with a 14-day recovery period.
10. Technical monitoring and alerts.
11. Technical-log retention of 30 days.
12. Private reporting of security incidents through ralph@ralpheckhard.com rather than public GitHub issues.

Appendix 3 — Approved subprocessors

No payment processor is used for the free pilot. Voluntary GitHub sponsorship is separate from the hosted service and does not provide access to customer content.