1. Parties and purpose
This agreement is entered into between the Client, acting as controller, and Energy Expertise SRL, trading as Makeset, Rue de l'Abbaye 7, 4880 Aubel, Belgium, company number 0898.341.645, acting as processor.
It applies when Makeset processes personal data on behalf of the Client as part of the services provided for in the terms and conditions, of which it forms part. It implements Article 28 of Regulation (EU) 2016/679 (GDPR).
2. Description of the processing
- Nature and purpose : hosting, maintenance, backup and operation of the website, forms, bookings and modules subscribed to by the Client.
- Categories of data : depending on the services, names, contact details, email addresses, messages, form contents, booking data and technical connection data.
- Data subjects : the Client's customers, prospects, visitors and users.
- Duration : the term of the contract, followed by the return or deletion period set out in article 9.
The Client does not entrust Makeset with special categories of data within the meaning of Article 9 GDPR without prior written agreement.
3. Client's instructions
Makeset processes the data only on documented instructions from the Client, including with regard to transfers outside the European Economic Area, unless required to do so by law to which Makeset is subject; in that case, Makeset informs the Client before processing, unless the law prohibits it. The terms and conditions, this agreement and the settings chosen by the Client constitute its instructions. Makeset immediately informs the Client if, in its opinion, an instruction infringes the GDPR.
4. Privacy
Persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
5. Security
Makeset implements the technical and organisational measures required by Article 32 GDPR, described in the "Information security" article of the terms and conditions.
6. Sub-processors
The Client gives Makeset general authorisation to engage the following sub-processors:
- Hostinger, for the VPS infrastructure located in France;
- Cloudflare, for DNS, content delivery, security and abuse prevention;
- one.com, for email services.
Makeset informs the Client of any addition or replacement of a sub-processor before it takes effect. The Client may object on reasonable grounds; failing agreement, it may terminate the service concerned.
Makeset imposes on each sub-processor data protection obligations equivalent to those of this agreement and remains liable to the Client for their performance.
7. Transfers outside the European Economic Area
Data is transferred outside the European Economic Area only if the transfer is covered by a safeguard provided for in Chapter V GDPR, as described in the privacy policy.
8. Assistance to the Client
Makeset assists the Client, insofar as possible and taking into account the nature of the processing, in responding to requests to exercise data subjects' rights. Makeset forwards to the Client without delay any request it receives directly.
Makeset assists the Client in complying with its obligations regarding security, impact assessments and prior consultation of the supervisory authority (Articles 32 to 36 GDPR).
Makeset notifies the Client of any personal data breach without undue delay after becoming aware of it, with the information available, supplemented in phases. It is for the Client to determine the notifications required to the authority and to data subjects.
9. End of processing
At the end of the services, Makeset, at the Client's choice, returns or deletes the data and deletes existing copies, unless retention is required by law. Data in backups is deleted according to the backup rotation cycle.
10. Information and audits
Makeset makes available to the Client the information necessary to demonstrate compliance with Article 28 GDPR and allows for audits, including inspections, by the Client or an auditor it mandates, with reasonable notice and with due regard for the confidentiality and security of other clients.
11. Client's obligations
The Client warrants that it has a valid legal basis for the data entrusted to Makeset and that it provides the required information to data subjects.
12. Term and governing law
This agreement applies for as long as Makeset processes data on behalf of the Client. It is governed by Belgian law and by the jurisdiction rules of the terms and conditions. For any question: contact@makeset.be.