Data Processing Agreement

DRAFT — pending legal review. This document is a carefully prepared draft and has not yet been reviewed by a lawyer. No rights may be derived from this version until the final version is published. The Dutch version (Verwerkersovereenkomst) prevails in case of any discrepancy.

Version 1 (draft) — 13 July 2026

This Data Processing Agreement ("DPA") forms part of the agreement between Picked B.V. ("Processor", "Picked") and the customer using a workspace on picked.nl ("Controller", the "Customer"), as referred to in Article 28(3) of the General Data Protection Regulation (GDPR).

This DPA is pre-signed by Picked (see section 12). The Customer accepts it digitally in the portal; that acceptance is recorded with workspace, user, document version and timestamp and constitutes the Customer's signature.

1. Subject matter and duration

1.1. Picked processes, on the Customer's instructions, the personal data the Customer enters (or has entered) into the Picked service ("Customer Data"), exclusively to provide the service described in the Terms of Service.

1.2. This DPA remains in force for as long as the main agreement lasts, and thereafter for as long as Picked holds Customer Data.

2. Nature, purpose and categories (Annex A)

The nature and purpose of the processing, the categories of data subjects and the categories of personal data are described in Annex A. The Customer warrants that it has a valid legal basis for the processing of the Customer Data and that its processing instructions are lawful.

3. Instructions

3.1. Picked processes Customer Data only on the Customer's documented instructions. Use of the service (including configuration in the portal and API calls) constitutes such instructions.

3.2. Picked does not process Customer Data for its own purposes and does not train models on it. Aggregated statistics that cannot be traced to persons or to the Customer fall outside the definition of Customer Data.

3.3. If Picked considers an instruction to infringe the GDPR, Picked informs the Customer without delay.

4. Confidentiality

Persons processing Customer Data under Picked's authority are bound by confidentiality. Access to Customer Data is limited to what is necessary to provide and support the service.

5. Security (Annex B)

Picked implements appropriate technical and organisational measures as described in Annex B. Picked may update these measures, provided the level of protection is not materially reduced.

6. Sub-processors (Annex C)

6.1. The Customer grants general authorisation for the engagement of sub-processors. The current list is published at picked.nl/legal/sub-processors and forms part of this DPA as Annex C.

6.2. For any intended addition or replacement, Picked updates the list and informs the Customer (via the portal or email) at least 30 days in advance. The Customer may object on reasonable grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the main agreement effective as of the date the change takes effect.

6.3. Picked imposes obligations on sub-processors equivalent to this DPA and remains responsible to the Customer for their performance.

6.4. Warehouse data is stored in the Netherlands by default. For sub-processors outside the EEA, appropriate safeguards are put in place (such as EU Standard Contractual Clauses); the specifics per sub-processor are set out in Annex C.

7. Assistance to the Customer

7.1. Taking into account the nature of the processing, Picked assists the Customer in responding to data-subject requests (access, rectification, erasure, portability). Much of this is self-service: data can be viewed and corrected in the portal, and a full export is available via Settings → Data & privacy.

7.2. Picked assists the Customer with the obligations under Articles 32–36 GDPR (security, breach notification, DPIA), insofar as the necessary information is held by Picked.

8. Personal data breaches

Picked informs the Customer without undue delay after establishing a personal data breach that (potentially) affects Customer Data, providing the information the Customer needs for its own notification obligations (nature of the breach, categories concerned, likely consequences, measures taken). Notification to the supervisory authority and to data subjects is the responsibility of the Customer as controller.

9. Audit

9.1. On request, Picked makes available the information reasonably necessary to demonstrate compliance with this DPA, including the security description at picked.nl/security and Annex B.

9.2. At most once per year, upon 30 days' notice, the Customer (or an independent auditor bound by confidentiality who is not a competitor of Picked) may conduct an audit, during business hours and without disproportionate disruption. Each party bears its own costs.

10. Deletion and return

10.1. During the agreement, the Customer can export Customer Data via the portal (JSON/CSV).

10.2. After the end of the main agreement, a 30-day recovery window applies during which the Customer can still request an export. Thereafter Picked permanently deletes all Customer Data: database records and files are erased and event records are irreversibly anonymised. Erased data may persist in encrypted backups for up to 90 days, after which it expires automatically; backups are never used to restore erased data to live systems. A verifiable log artefact of the deletion is retained that itself contains no personal data.

10.3. Statutory retention obligations (such as tax retention of invoices) remain unaffected.

11. Liability

Liability under this DPA is governed by the liability provisions of the Terms of Service, except to the extent mandatory law (including Article 82 GDPR) provides otherwise.

12. Signature

Pre-signed on behalf of Picked B.V.:

On behalf of the Customer: digital acceptance in the portal (recorded with workspace, user, document version and timestamp) constitutes signature.

Annex A — Processing details

Annex B — Technical and organisational measures

• Encrypted connections (TLS) for all traffic; encrypted storage of integration credentials.
• Strict tenant isolation, enforced in the application layer and continuously guarded by automated (architecture) tests.
• Role- and permission-based access control; two-factor authentication available for all accounts.
• Logging of administrative and security-relevant actions (audit log, visible to the Customer in the portal).
• Infrastructure in the Netherlands (TransIP), with a separated production environment and secrets kept outside source code.
• Error reporting with personal data removed before transmission (PII scrubbing).
• Vulnerability policy and coordinated disclosure via picked.nl/security and security.txt.
• Deletion and anonymisation procedure at offboarding (see section 10), including media and exports.

Annex C — Sub-processors

The current list at picked.nl/legal/sub-processors constitutes Annex C. Changes follow section 6.