The DPA, in outline.
A short summary of the Data Processing Agreement Arcken signs with every paid engagement. The full, current version is sent on request. Email hello@arcken.nl.
We publish this early so it’s on the site when procurement asks for it. The content here updates as engagements require. Material changes land with a new “last updated” date and a note in the footer.
01 · The parties
- Processor
- Arcken B.V. · Amsterdam, Netherlands
- Establishment
- European Union · KvK {{kvk-number}}
- Contact
- hello@arcken.nl
- Controller
- The paying customer, named in the SOW
KvK number is a token until the company registration lands in writing, filled before the first paid engagement.
02 · What we process
Inside an engagement, Arcken processes personal data on your behalf. The shape of the data depends on the build. A renewal-agent deployment touches customer contact data and commercial terms. An internal-tool build touches whatever is in the data sources you connect, or the data the replaced tool used to hold.
Categories, purposes, and duration are named in the SOW, not inferred from a template. This stub sits above that. It is the framework, not the specifics.
03 · Sub-processors
Sub-processors for each engagement are listed in the SOW and the full DPA. We do not bring in a new sub-processor without notice. If a replacement is required, the customer hears about it before it happens.
For the marketing-site and contact-form chain, see the security page.
04 · Data subject rights
When a customer’s end-user exercises a GDPR right against you as controller (access, correction, deletion, portability, objection), we assist as processor. Turn-around is within the timeline the GDPR requires of the controller.
If you need an audit, we accommodate one per engagement per year, by remote review, in line with Article 28(3)(h). The shape is named in the SOW.
05 · Breach notification
We notify the controller without undue delay and in any event within 72 hours of becoming aware of a personal-data breach affecting processed data. The notification includes what we know at the time and is updated as we learn more.
06 · Requesting the full DPA
The full, current DPA (including the standard contractual clauses where they apply, the sub-processor list, and the technical and organisational measures annex) is sent per engagement. Email hello@arcken.nl with the subject Arcken DPA request and we reply within a business day.
Questions
For anything on this page (a missing clause, a clarification, a request), email the founders directly. Named human on the other end, reply within a business day.