This is a translation. In case of any difference, the Dutch version prevails.
Version: 28 October 2026
This data processing agreement belongs to every Smardly Team subscription and forms part of the Agreement under the Terms and Conditions of Smardly BV (article 7.5).
1.1. Controller: the Business Customer who takes out a Smardly Team subscription, hereinafter: the Customer.
1.2. Processor: Smardly BV, established at Mgr. Buxckstraat 8, 6134 AP Sittard, registered with the Chamber of Commerce under number 80435602, hereinafter: Smardly.
1.3. This data processing agreement is formed at the moment the Customer takes out the Team subscription and accepts the Terms and Conditions. A separate signature is not required. If the Customer wants a signed copy, Smardly will send one on request.
2.1. Terms such as personal data, processing, data subject, controller, processor and personal data breach (data breach) have the meaning given in the General Data Protection Regulation (GDPR).
2.2. User: an employee or other person for whom the Customer creates or manages a profile within Smardly Team.
2.3. Sub-processor: a party engaged by Smardly that processes personal data of the Customer in doing so.
2.4. Other capitalised terms have the meaning given in the Terms and Conditions of Smardly BV.
3.1. Smardly processes personal data of Users on behalf of the Customer, solely to provide Smardly Team: work profiles, public profile pages, Wallet passes, QR codes, NFC cards, statistics and, with a Team Pro licence, the rights in Smardly Voice.
3.2. Which data this concerns, of whom and for what, is set out in Annex 1.
3.3. The Customer determines the purpose and means of the processing. The Customer warrants that it has a valid legal basis for having the data of its Users processed by Smardly, and that it informs its Users about this.
3.4. This agreement does not cover: the private accounts and private profiles of Users, and the data of the Customer itself as a customer of Smardly (contact person, invoicing). For these, Smardly is the controller itself, in accordance with its privacy statement. Smardly does not process recordings, transcripts and summaries in Smardly Voice: they are on the User's device and in the User's iCloud.
4.1. Smardly processes the personal data only on the basis of written instructions from the Customer. The settings that the Customer chooses in the Smardly Team management environment, and this agreement, count as those instructions.
4.2. If Smardly is legally required to process data in another way, it will notify the Customer of this in advance, unless the law prohibits this.
4.3. If Smardly believes that an instruction infringes the GDPR, it will notify the Customer immediately.
5.1. Smardly keeps the personal data confidential. Only employees who need them for their work have access to them, and they are bound by a duty of confidentiality.
6.1. Smardly takes appropriate technical and organisational measures to protect the personal data against loss and unlawful processing. These measures are set out in Annex 3.
6.2. Smardly may adapt the measures, as long as the level of security does not decrease.
7.1. The Customer gives Smardly general authorisation to engage the sub-processors listed in Annex 2.
7.2. If Smardly wants to add or replace a sub-processor, it will notify the Customer by e-mail at least 30 days in advance. Within that period the Customer may object on reasonable grounds. If the parties cannot agree, the Customer may cancel the Team subscription free of charge with effect from the date on which the change takes effect.
7.3. Smardly imposes on each sub-processor at least the same obligations as set out in this agreement, and remains responsible towards the Customer for their performance.
7.4. Smardly only transfers personal data to a country outside the European Economic Area if an appropriate safeguard under the GDPR applies, such as an adequacy decision (including the EU-US Data Privacy Framework) or the standard contractual clauses of the European Commission.
8.1. The Customer can handle many requests from Users itself in the management environment: viewing and changing data and deleting profiles.
8.2. If a request from a User reaches Smardly, Smardly will forward it to the Customer within five working days and will not handle it itself.
8.3. Smardly assists the Customer, insofar as reasonable, in complying with its obligations under the GDPR, such as a data protection impact assessment (DPIA) or a query from the Dutch Data Protection Authority. If that assistance goes beyond what is possible in the management environment, Smardly may charge the reasonable costs thereof, after prior consultation.
9.1. If Smardly discovers a data breach that concerns the Customer's data, it will notify the Customer without undue delay and at the latest within 48 hours, via the e-mail address of the administrator of the Team account.
9.2. The notification contains, insofar as known: what happened, which data and how many Users are concerned, the likely consequences and the measures Smardly takes or proposes. Smardly will supplement what is not yet known as soon as it becomes known.
9.3. The Customer decides whether to report the data breach to the Dutch Data Protection Authority and to the Users. Smardly does not do this itself, unless the law obliges it to.
10.1. On request, Smardly provides the Customer with the information necessary to demonstrate that it complies with this agreement.
10.2. The Customer may, at most once a year and with at least 30 days' notice, have an audit carried out by an independent expert who has agreed to confidentiality. The Customer bears the costs. If the audit shows that Smardly materially fails to comply with this agreement, Smardly will remedy this at its own expense.
11.1. This agreement runs for as long as the Team subscription runs, and thereafter for as long as Smardly still processes personal data of the Customer.
11.2. After the Team subscription ends, the Customer can make an export of the work profiles for 30 days. After that, Smardly deletes the work profiles and the associated statistics within 60 days, including copies in back-ups as soon as these expire under the normal schedule. Data that Smardly is legally required to keep, such as invoices, are not covered by this.
11.3. On request, Smardly confirms in writing that the data have been deleted.
11.4. After deletion, web addresses and QR codes on NFC cards of deleted profiles show a general page without personal data.
12.1. The liability of the parties under this agreement is governed by article 19 of the Terms and Conditions of Smardly BV, insofar as the GDPR does not provide otherwise.
13.1. In the event of a conflict between this agreement and the Terms and Conditions, this agreement prevails, insofar as it concerns the processing of personal data.
13.2. Smardly may amend this agreement if the law, the interpretation of the law or the service makes this necessary. An amendment that is to the Customer's disadvantage is announced at least 30 days in advance; the Customer may then cancel the Team subscription free of charge with effect from the effective date.
13.3. This agreement is governed by Dutch law. Disputes are submitted to the competent court in the district where Smardly is established.
| Item | Description |
|---|---|
| Data subjects | Users: employees and other persons for whom the Customer creates a work profile. Visitors to those profiles, only as an anonymous count |
| Data | Name, job title, department, business e-mail address and phone number, photo, company details, business social media links and whatever else the Customer or the User puts in the profile. Statistics per profile: date, time, way of opening (NFC, QR, link) and referring page, without the visitor's IP address. Account data of Users and administrators: name, e-mail, login identifiers and the assigned right (base profile or Team Pro licence) |
| Special categories of data | None. The Customer does not put special categories of personal data (such as health or religion) or the citizen service number in profiles |
| Purpose | Providing Smardly Team: work profiles, public profile pages, Wallet passes, QR codes, NFC cards, management and statistics, and granting rights in Smardly Voice |
| Duration | As long as the Team subscription runs, and thereafter as set out in article 11 |
| Sub-processor | Purpose | Location of the processing |
|---|---|---|
| Laravel Cloud | Hosting of the application and the database | [to be completed] |
| Mailgun | Sending invitation and service e-mails | [to be completed] |
| Sentry | Technical error messages, without names or e-mail addresses | [to be completed] |
| Apple | Wallet passes and updating them on the User's phone | United States, under the EU-US Data Privacy Framework |
| Microsoft, Google and Apple | Logging in with an existing account, only if the User chooses to | United States, under the EU-US Data Privacy Framework |
© 2020 - 2026 Smardly B.V. All rights reserved