Meldklok

Data processing agreement

Draft, to be reviewed by a lawyer before launch.

This agreement is part of the terms of service. You are the controller of the personal data you put into Meldklok; to verify is the processor. Last updated 2026-08-31.

Subject, duration and nature

We process personal data on your instruction to deliver the service: monitoring the SBOMs you upload, alerting the people you name, tracking deadlines, preparing dossiers and keeping the audit trail. The processing lasts as long as your subscription, plus the deletion period in the terms.

Categories of data subjects: your users and the people named in an incident. Categories of data: name, business email address, role, and the actions those people take inside the tool.

Our obligations

  • We process only on your documented instruction, which the terms and this agreement contain.
  • Everyone with access is bound to confidentiality.
  • We take the security measures listed in the privacy policy and keep them current.
  • We help you answer data subject requests and, given the nature of the processing, with your obligations under Articles 32 to 36 GDPR.
  • We tell you without undue delay about a personal data breach, with what we know at that moment.
  • At the end of the contract we return or delete the data, at your choice, except what we must keep.

Subprocessors

You give a general authorisation for the subprocessors below. We tell you at least 30 days before a new subprocessor starts, and you may object and terminate if the objection cannot be resolved.

  • Hetzner Online GmbH: Hosting of the application, the database and the backups. Germany or Finland (EU). PRD section 8: all application data, files and backups stay on EU infrastructure.
  • Stripe: Subscription billing and invoices. EU and United States. Stripe processes data outside the EU. to verify: the DPA and the transfer mechanism before launch.
  • Transactional email provider: Alerts, reminders and account mail. EU. to verify: the chosen provider (Scaleway TEM or Brevo) and its DPA before launch.

Transfers outside the EU

The service runs on EU infrastructure. Stripe processes billing data outside the EU; that transfer relies on the mechanism named in its own agreement, which is "to verify" before launch.

Audits

We give you the documentation you need to show compliance with this agreement. An audit beyond that is possible once a year, announced in advance, at your cost, and without touching the data of other customers.

Liability

Liability under this agreement follows the limitation in the terms of service.

to verify, to verify, the Netherlands. albert@beltar.nl.