Data Processing Agreement

This Data Processing Agreement forms part of the Agreement between EventDock B.V. ("EventDock") and the Client and applies as soon as EventDock processes personal data on behalf of the Client in performing the Agreement.

Definitions: - Products: hardware and equipment, including camera, access, connectivity and security systems. - Services: installation, configuration, management, maintenance, monitoring, connectivity, cloud and software services, and support. - Rental: making Products available temporarily. - Sale: transfer of ownership of Products. - Managed systems: systems on which EventDock performs remote management or Services, whether rented or purchased. - Agreement: everything contractually agreed between EventDock and the Client.

Controller: The Client determines the purpose and means of the camera and security surveillance: where the cameras are placed, what is captured, which detection features are active, who may view the images and how long images are retained. The Client is therefore the controller within the meaning of article 4(7) GDPR.

Processor: EventDock processes such personal data solely on the instructions and on behalf of the Client and is therefore the processor within the meaning of article 4(8) GDPR.

EventDock's own processing: For data EventDock processes for its own purposes, such as client administration, quotations, invoicing, contact, support and website use, EventDock is itself the controller. Our Privacy Policy applies to that processing, not this Data Processing Agreement.

Subject matter: The supply, rental, sale, installation, configuration, management, maintenance and, where agreed, monitoring of camera, access, connectivity and security systems and associated software and cloud services.

Nature of the processing: Recording, storing, transmitting (streaming), viewing, exporting, erasing and securing images and related metadata, as well as analysing, detecting and classifying events and objects by means of automated image analysis.

Types of personal data: - Images of persons who come within the field of view of the cameras - Related metadata such as date, time, location and camera identification - Detection events, motion data, object classifications, snapshots, alarm events and other metadata generated by the security system - For ANPR applications: licence plates and vehicle characteristics - For facial recognition: biometric data (see article 3) - Access and log files of users of the management portal

Categories of data subjects: Visitors to the location, employees and subcontractors of the Client, passers-by and, in the case of ANPR, keepers of registered vehicles.

Duration: This Data Processing Agreement applies for as long as EventDock processes personal data on behalf of the Client under the Agreement and ends once the relevant processing services have been terminated and the personal data have been erased or returned in accordance with article 10. The duration is not tied to a single rental period: in the case of a Sale with ongoing Services, this Data Processing Agreement continues to apply for as long as those Services are provided.

Processing details per assignment: The specific configuration per assignment (system, detection features, ANPR, monitoring, storage location, retention period and term) is recorded in Annex A.

3.1. EventDock processes personal data solely on the basis of the Client's written instructions and not for its own purposes.

3.2. Instructions are recorded in the Agreement, the order confirmation, Annex A and the settings selected in the management portal.

3.3. EventDock does not process personal data outside the Client's instructions, unless required to do so by a provision of Union or national law applicable to EventDock. In that case EventDock informs the Client of that legal requirement before processing, unless that requirement prohibits such notification.

3.4. EventDock informs the Client without delay if, in EventDock's opinion, an instruction infringes the GDPR or other applicable legislation.

3.5. The Client warrants that a valid legal basis exists for the processing and that, where the processing is based on a legitimate interest, the required balancing test has been carried out. The Client further warrants that a DPIA has been carried out where necessary and that data subjects at the location are clearly informed about the camera and security surveillance.

3.6. Camera images may unavoidably contain data that could indicate special categories of personal data. EventDock does not use automated image analysis to infer sensitive characteristics such as health, ethnicity, religious belief or political opinion. The Client is responsible for limiting the camera view to what is necessary.

3.7. Facial recognition involves the processing of biometric data for the purpose of unique identification and constitutes processing of special categories of personal data within the meaning of article 9 GDPR. This functionality is activated solely on the Client's express, documented instruction. The Client is responsible for a valid exception under article 9 GDPR, for the DPIA that is in principle mandatory, and for informing data subjects.

4.1. EventDock undertakes to keep confidential all personal data it processes on behalf of the Client.

4.2. EventDock's staff and engaged third parties are contractually bound by confidentiality and are granted access only in so far as necessary for their task (need-to-know).

4.3. The confidentiality obligation continues to apply after termination of the Agreement.

5.1. EventDock implements appropriate technical and organisational measures in accordance with article 32 GDPR. The measures EventDock actually applies are described in Annex B and are reviewed periodically and adjusted where necessary.

5.2. Connections for streaming and accessing images are encrypted (TLS). Storage of images is protected with appropriate measures, including encryption where the relevant storage facility supports it. EventDock does not warrant that every form of storage applies encryption at rest; the applicable form of storage follows from the configuration and Annex A.

5.3. A distinction is made between the following forms of storage:
- local storage on EventDock equipment on site
- local storage in the Client's systems or on the Client's own equipment
- EventDock cloud storage, only where agreed
- external third-party cloud or platform services, where the Client chooses this or it forms part of the agreed configuration

For data in the Client's systems or with an external party chosen by the Client, that Client or that supplier respectively is responsible for security, access, retention and deletion.

5.4. The Client is responsible for carefully managing its own accounts, limiting the group of users and promptly revoking access for departing employees.

6.1. The Client grants EventDock general authorisation to engage sub-processors. For the purposes of this Data Processing Agreement, only parties that process personal data on behalf of EventDock for the Client qualify as sub-processors, such as hosting, storage, remote access and management of security systems. Suppliers that process only data for which EventDock is itself the controller, such as payment and email services for its own administration, are not sub-processors under this Data Processing Agreement.

6.2. EventDock imposes on sub-processors obligations that are at least equivalent to those set out in this Data Processing Agreement.

6.3. An up-to-date list of sub-processors is set out in Annex C. EventDock informs the Client at least 14 days before the intended engagement or replacement of a sub-processor, so that the Client may object. In the event of an urgent change necessary for the security or continuity of the services, EventDock informs the Client as soon as possible and no later than immediately after the change.

6.4. If an objection is maintained and no reasonable alternative can be found, the Client may terminate the relevant part of the Agreement without penalty.

6.5. EventDock remains fully liable to the Client for the performance of the obligations under this Data Processing Agreement by its sub-processors.

7.1. Camera images and associated security metadata are in principle stored and processed within the European Economic Area. EventDock verifies this per supplier and records the actual processing location and any transfer mechanism in Annex C.

7.2. For supporting services, such as cloud and management platforms, support and supplier telemetry, limited processing outside the EEA may occur. In that case EventDock bases the transfer on an adequacy decision of the European Commission or on the Standard Contractual Clauses, with additional measures where necessary.

7.3. EventDock follows the Client's documented instructions regarding international transfers of personal data. Without an instruction or a valid transfer mechanism, no transfer outside the EEA takes place.

7.4. EventDock does not disclose personal data to authorities outside the EEA unless legally required to do so; in that case EventDock informs the Client as soon as this is permitted.

8.1. Requests from data subjects (access, rectification, erasure, restriction, portability or objection) are handled by the Client as controller.

8.2. If EventDock receives a request concerning data it processes on behalf of the Client, EventDock does not handle the substance of that request independently without the Client's instruction, unless legally required to do so. EventDock informs the Client within 3 working days and, where appropriate, refers the data subject to the Client.

8.3. Taking into account the nature of the processing and the information available to it, EventDock provides the Client with the assistance necessary to handle data subject requests, for example by locating, exporting or erasing image fragments. This necessary support is included. Only for exceptional or bespoke work reasonably falling outside that scope may EventDock charge costs at the applicable hourly rate, subject to prior notice.

9.1. A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data processed. This includes unauthorised viewing of images, lost or stolen equipment and accidentally shared image fragments.

9.2. EventDock informs the Client without undue delay and in any event within 24 hours of becoming aware of a personal data breach.

9.3. The notification includes, in so far as known: the nature of the breach, the categories of data and data subjects concerned, the likely consequences and the measures taken or proposed. EventDock provides additional information without undue delay as it becomes available.

9.4. EventDock does not itself notify a supervisory authority or data subjects on behalf of the Client, unless agreed otherwise in writing. The Client assesses whether notification is required.

9.5. EventDock supports the Client in investigating the incident, limiting its consequences and documenting it.

10.1. The Client determines the retention period, taking into account the purpose of the processing, the principle of storage limitation and applicable laws and regulations. Unless agreed otherwise, the technically configured default retention period is 7 days.

10.2. After termination of the relevant processing services, EventDock erases all personal data it processes on behalf of the Client, or returns them, at the Client's choice. Erasure or return takes place no later than 30 days after termination, unless the Client requests earlier erasure or statutory retention obligations prevent it.

10.3. At the Client's request, EventDock makes an export available in a commonly used format prior to erasure.

10.4. Personal data in technical backups are deleted in accordance with the regular backup retention cycle and are not processed for any other purpose during that period.

10.5. Equipment is wiped after return or replacement before being issued again.

11.1. Taking into account the nature of the processing and the information available to it, EventDock provides the Client with reasonable assistance in complying with the obligations under articles 32 to 36 GDPR, including security of processing, notifying and documenting personal data breaches, data protection impact assessments (DPIAs) and prior consultation of a supervisory authority.

11.2. EventDock does not write the Client's DPIA, but on request provides the technical and organisational information the Client needs for it, including information on cameras and positioning, detection and analysis features, ANPR and facial recognition where applicable, form and location of storage, access management, logging, security measures and sub-processors.

11.3. This assistance is included in normal use. Article 8.3 applies only to exceptional or bespoke work.

12.1. On request, EventDock makes available the information with which the Client can demonstrate compliance with article 28 GDPR, including the overview of technical and organisational measures (Annex B), the sub-processor list (Annex C) and, where available, certifications and relevant audit reports.

12.2. The Client may have an audit carried out by an independent expert no more than once a year, subject to at least 30 days' notice and during office hours.

12.3. The limitations in article 12.2 do not apply where an additional audit is reasonably necessary because of a personal data breach, concrete indications of non-compliance or a request from a competent supervisory authority.

12.4. EventDock allows for and contributes to audits. The costs of the audit are borne by the Client, unless the audit shows that EventDock is failing to comply with this Data Processing Agreement.

12.5. Where a shortcoming is established, EventDock remedies it within a reasonable period.

13.1. The limitations of liability set out in EventDock's General Terms and Conditions apply to this Data Processing Agreement, in so far as the GDPR permits.

13.2. In the event of a conflict between this Data Processing Agreement and the General Terms and Conditions, this Data Processing Agreement prevails in so far as the processing of personal data is concerned. For the remainder, the order of precedence of documents set out in the General Terms and Conditions applies.

13.3. Every legal relationship arising out of or connected with this Data Processing Agreement is governed exclusively by Dutch law, irrespective of the country in which the Products are delivered, positioned, installed or used. The United Nations Convention on Contracts for the International Sale of Goods (CISG) is expressly excluded. All disputes are, in so far as legally permitted, submitted exclusively to the competent Dutch court in the district in which EventDock has its registered office. This choice of law and forum is identical to that in the General Terms and Conditions.

13.4. Would you like a signed version of this Data Processing Agreement? Request one via privacy@eventdock.nl and we will send a copy in your organisation's name, including the completed Annex A.

This annex is completed per assignment and forms part of this Data Processing Agreement. Where the services change, only this annex is amended.

- Service: Rental / Sale / Installation / Managed system - System: Case / Pole / Tower / Edge / Connect / permanent system - Camera surveillance: yes / no - AI detection: persons / vehicles / other objects / not active - ANPR (licence plate recognition): yes / no - Facial recognition: yes / no (if yes: solely on documented instruction, see article 3.7) - Monitoring and alarm response: yes / no - Form of storage: local on EventDock equipment / local at Client / EventDock cloud / external cloud - Storage location: in principle EEA (see Annex C) - Retention period: 7 days by default, unless recorded otherwise - Categories of data subjects: visitors / employees / subcontractors / passers-by / vehicle keepers - Special processing: where applicable - Term: duration of the relevant Services

EventDock applies the following measures. This annex is updated whenever the measures change.

• Encrypted connections (TLS) for streaming and accessing images
• Unique login credentials per user; no shared accounts
• Role-based access rights on a need-to-know basis
• Logging of access to images and of changes to system settings
• Firmware and software updates on the camera and security systems
• Physical security of equipment, locks and enclosures of masts, cases and installations
• Password policy and authorisation management within EventDock
• Periodic review of the configuration on installation, change and return
• Wiping of equipment before it is issued again
• Contractual confidentiality for staff and engaged third parties

Measures not listed here are not given by EventDock as a contractual warranty. Where the Client requires additional measures, these are agreed separately.

Below are the parties that process personal data on behalf of EventDock for the Client. Suppliers that process only data for which EventDock is itself the controller, such as payment and email services, are not listed here; see the Privacy Policy.

For each sub-processor, the legal name, the service, the categories of personal data, the purpose, the processing location and any transfer mechanism are recorded. The current overview is set out in the table at the bottom of this page and is available on request via privacy@eventdock.nl.

Questions about this Data Processing Agreement? Please contact us:

EventDock B.V. Dortherweg 29 7214 PS Epse, the Netherlands Chamber of Commerce: 42095557 Email: privacy@eventdock.nl Phone: +31 85 505 5059 Website: www.eventdock.nl