# DATA PROCESSING AGREEMENT (DPA)

## Rule Step B.V. [besloten vennootschap; private limited liability company]

---

**Version:** 1.0
**Date of entry into force:** 30 September 2026

This document has been drawn up in accordance with the requirements of the Algemene Verordening Gegevensbescherming [General Data Protection Regulation] (hereinafter: "AVG" [GDPR]) and the Uitvoeringswet Algemene Verordening Gegevensbescherming [Dutch GDPR Implementation Act] (hereinafter: "UAVG").

This Data Processing Agreement (Verwerkersovereenkomst) forms part of the agreement between Rule Step B.V. and the Customer (hereinafter referred to as: "Agreement"), alongside the General Terms and Conditions ("AW"), the applicable Supplementary Terms and Conditions (AVO for online services; AVC for consulting), and the Order Form. Definitions from the AW (AW Art. 1.1) apply mutatis mutandis.

---

### Parties

1. **[Name controller]**, established at [Address], registered with the Kamer van Koophandel [Dutch Chamber of Commerce] under number [KvK number], in this capacity acting as the controller (hereinafter: "Controller" / "Verwerkingsverantwoordelijke");

2. **Rule Step B.V.**, having its statutory seat in Amsterdam, the Netherlands, registered with the Kamer van Koophandel under number 42042967, with RSIN 869445200 [Rechtspersonen en Samenwerkingsverbanden Identificatienummer; Legal Entities and Partnerships Identification Number], in this capacity acting as the processor (hereinafter: "Processor" / "Verwerker").

Controller and Processor are hereinafter jointly referred to as the "Parties" and each individually as a "Party".

### Recitals

Considering that:

- the Controller processes personal data in the exercise of its business activities;
- the Controller, for certain processing operations, makes use of the services of the Processor, whereby the Processor will process personal data on behalf of the Controller;
- the processing of personal data by the Processor takes place on the instructions of the Controller;
- the Parties have the obligation, pursuant to Article 28(3) AVG (GDPR), to conclude a data processing agreement that contains specific minimum conditions with regard to the processing of personal data;
- the Processor (Rule Step B.V.), in its capacity as hosting provider and ICT service provider, makes use of dedicated servers and VPSs with hosting partners in the EEA (Europese Economische Ruimte [European Economic Area]), and supplies domains via Realtime Register, TransIP and Gandi.net;
- the Parties expressly wish to record their rights and obligations with regard to the processing of personal data in this Data Processing Agreement.

---

### Article 1 — Definitions and Interpretation

1.1. The terms used in this Agreement have the same meaning as in the AVG and the UAVG. In case of doubt, the definition as included in the AVG prevails.

1.2. "AVG": Verordening (EU) 2016/679 [Regulation (EU) 2016/679] of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

1.3. "UAVG": the Uitvoeringswet Algemene Verordening Gegevensbescherming [Dutch GDPR Implementation Act].

1.4. "Personal Data" (Persoonsgegevens), "Processing" (Verwerking), "Personal Data Breach" (Datalek), "Sub-processor" (Sub-verwerker), "Standard Contractual Clauses" (Standaard Contractuele Bepalingen) (SCCs), "Supervisory Authority" (Toezichthoudende Autoriteit): have the meaning as in the AVG (GDPR) (Article 4).

1.5. "Services": the online services (hosting, VPS, domains, e-mail, certificates, licences, back-up) and — insofar as applicable — consulting services, whereby the Processor processes personal data on behalf of the Controller.

---

### Article 2 — Processing Instructions (Art. 28(1) and (3)(a) AVG)

2.1. The Processor processes the Personal Data exclusively on the documented instruction of the Controller, including the authorisations to transfer personal data, unless the Processor is required to do so pursuant to Union law or the law of the Member State; in that case, the Processor informs the Controller of this legal requirement prior to the processing, unless that law prohibits informing the Controller thereof.

2.2. The nature and the purpose of the processing, the types of personal data and the categories of data subjects are recorded in Annex A.

2.3. The Controller is at all times authorised to give new, amended or supplementary instructions with regard to the processing. The Processor carries out these instructions without delay, provided that these fall within the framework of the Agreement.

2.4. If the Processor is of the opinion that an instruction infringes the AVG, the UAVG or other applicable laws or regulations, it shall inform the Controller thereof without delay.

2.5. The Processor is not authorised to process the Personal Data for its own purposes, nor to make these available to third parties, unless this is expressly prescribed by the Controller or by statutory provision.

2.6. For the processing of its own administrative data (customer management, invoicing), the Processor refers to the Privacy Policy (Privacybeleid) of Rule Step, which forms part of the Agreement.

---

### Article 3 — Confidentiality (Art. 28(3)(b) AVG)

3.1. The Processor guarantees that all persons who, under its authority, are authorised to process Personal Data have accepted an express, written or electronic confidentiality obligation before they are granted access to the Personal Data.

3.2. The confidentiality obligation referred to in the previous paragraph remains in force after termination of the employment contract or assignment relationship.

3.3. The Processor takes adequate measures to guarantee that only those persons who are strictly necessary for the performance of the Agreement have access to the Personal Data (principle of minimal data access, Article 5(1)(c) AVG).

---

### Article 4 — Security Measures (Art. 28(3)(c) and Art. 32 AVG)

4.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, the Processor takes appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures referred to in Article 32(1) AVG.

4.2. The Processor applies in any case the security measures specified in Annex C.

4.3. The Controller approves the security measures included in Annex C. The Processor may not substantially modify or withdraw these measures without the prior written consent of the Controller, unless the modification leads to a strengthening of the security.

4.4. If the Controller is of the opinion that the security measures are insufficient, it shall notify the Processor thereof in writing. The Parties shall hold consultations in order to strengthen the measures. The costs connected to such requests shall be borne by the Controller, unless the requests arise from a statutory obligation resting on the Processor.

---

### Article 5 — Sub-processors (Art. 28(2) and (3)(f) AVG)

5.1. The Controller hereby grants the Processor a general, prior written authorisation for engaging the Sub-processors listed in Annex B.

5.2. The Processor informs the Controller of any intended change with regard to the addition or replacement of Sub-processors, whereby the Controller is given the opportunity to object.

5.3. The Controller has the right to object to the intended change of Sub-processors. The objection must be submitted in writing and substantiated, within thirty (30) calendar days after the notification. If the Controller objects, the Parties shall enter into consultations in order to find an acceptable solution. If the Parties do not reach agreement, the Controller is entitled to dissolve the Agreement by means of a written notification to the Processor, without prejudice to the right of the Controller to compensation for damage.

5.4. Where the Processor, in the performance of the Agreement, makes use of the services of a Sub-processor, it shall impose on that Sub-processor the same obligations as those recorded in this Agreement, in particular with regard to appropriate technical and organisational measures.

5.5. The Processor remains at all times fully liable towards the Controller for the performance of the obligations of the Sub-processor.

5.6. The current list of Sub-processors is included in Annex B.

---

### Article 6 — Rights of Data Subjects (Art. 28(3)(e) AVG)

6.1. The Processor supports the Controller with appropriate technical and organisational measures for the exercise of the rights of data subjects (access, rectification, erasure, restriction of the processing, data portability, objection).

6.2. If a data subject submits a request to exercise one of his rights directly with the Processor, the Processor refers the data subject on to the Controller and informs the Controller in writing without delay, but at the latest within forty-eight (48) hours after receipt of the request, or as soon as reasonably possible after establishment of the request.

6.3. The Processor provides the Controller with full assistance in the handling of such requests, within five (5) working days after the request of the Controller.

6.4. The costs connected to the assistance of the Processor in the exercise of the rights of data subjects are included in the fee for the services, unless the request falls outside the scope of the Agreement or requires a disproportionate amount of effort.

---

### Article 7 — Personal Data Breach Notification (Art. 28(3)(f) and Art. 33-34 AVG)

7.1. The Processor informs the Controller of a Personal Data Breach without delay, and in any case no later than forty-eight (48) hours after it has discovered a Personal Data Breach.

7.2. The notification contains at least:

(a) the nature of the Personal Data Breach, including the categories and the estimated number of data subjects and Personal Data;
(b) the likely consequences of the Personal Data Breach for the data subjects;
(c) the measures that the Processor has taken or proposes in order to contain the Personal Data Breach;
(d) the contact details of the DPO [Data Protection Officer; Functionaris voor de Gegevensbescherming] or another contact point.

7.3. If not all information can be provided at the same time, the Processor may provide the information in phases, without unreasonable delay, in accordance with Article 33(4) AVG.

7.4. The Processor documents all Personal Data Breaches, including facts, effects and remedial measures, in accordance with Article 33(5) AVG.

7.5. The Processor is not authorised to report a Personal Data Breach to the Supervisory Authority on its own initiative, unless required to do so pursuant to Union law or national law.

7.6. The Processor takes all reasonable measures to remedy the cause of the Personal Data Breach without delay and to prevent repeated breaches.

---

### Article 8 — Audit Right (Art. 28(3)(h) AVG)

8.1. The Controller, or a third party designated in writing for this purpose who is bound by a confidentiality obligation, has the right to carry out audits in order to verify compliance with this Agreement and the AVG by the Processor.

8.2. The Processor provides full cooperation with such audits and makes all relevant information available.

8.3. The Controller notifies the Processor in good time, and in any case at least ten (10) working days prior to the audit, of the intended audit, unless the audit requires an unannounced character in the context of an investigation into a Personal Data Breach.

8.4. If the Processor holds a current certificate or report from an independent, qualified auditor (such as ISO 27001, SOC 2 Type II), the Controller may take this certificate into consideration and, insofar as sufficient assurance is thereby offered, refrain from a further audit.

8.5. The costs of an audit initiated by the Controller shall be borne by the Controller, unless the audit reveals that the Processor has attributably failed in the performance of its obligations.

---

### Article 9 — Data Retention and Deletion (Art. 28(3)(h) AVG)

9.1. After the end of the services, the Processor shall return or delete, at the choice of the Controller, all Personal Data processed on behalf of the Controller, unless storage is required pursuant to Union law or national law.

9.2. The return or secure deletion takes place within thirty (30) calendar days after termination of the Agreement.

9.3. Return takes place in a structured, commonly used and machine-readable format (such as CSV or JSON), in accordance with Article 20 AVG.

9.4. Deletion takes place in such a way that the data can no longer be restored (data wiping / cryptographic destruction).

9.5. Upon request, the Processor provides, within ten (10) working days after the deletion, a written certification of deletion.

9.6. Back-ups already made are securely deleted or anonymised within ninety (90) days after termination.

---

### Article 10 — International Data Transfers (Art. 44-49 AVG)

10.1. The Processor may only transfer Personal Data to a country outside the European Economic Area (EEA) if written authorisation to that effect has been granted by the Controller and the conditions of Chapter V AVG have been met.

10.2. Insofar as the processing takes place within the infrastructure of hosting partners in Germany or other EEA countries, no international transfer takes place, since these countries form part of the EEA.

10.3. For transfers to third countries (for example to ICANN in the United States), the Parties conclude the Standard Contractual Clauses (SCCs) in accordance with Implementing Decision (EU) 2021/914. The applicable modules are: Module 2 (Controller to Processor) and Module 3 (Processor to Sub-processor).

10.4. For transfers to the United States, the Processor, where applicable, makes use exclusively of Sub-processors that are demonstrably and currently certified under the EU-US Data Privacy Framework (DPF) of 2023, in accordance with Implementing Decision (EU) 2023/1795. **ICANN is not certified under the EU-US DPF**; for ICANN, SCCs + TIA apply.

10.5. The Processor has, in accordance with the recommendations of the European Data Protection Board (EDPB 01/2020), carried out a Transfer Impact Assessment (TIA) or will carry one out for each transfer to a third country.

10.6. If the TIA requires supplementary measures, these shall be implemented at its own expense, unless specific adjustments are required that fall outside the standard services.

10.7. The Processor notifies the Controller without delay of (i) a request from a third-country authority for access to Personal Data, and (ii) any restrictions imposed on it to report such a request, unless this is legally prohibited to it.

---

### Article 11 — Liability (Art. 82 AVG)

11.1. The Processor is liable for damage arising from a failure in the performance of its obligations under this Agreement, the AVG, the UAVG, or from unlawful act (onrechtmatige daad) (6:162 BW [Burgerlijk Wetboek — Dutch Civil Code]) and breach of contract (wanprestatie) (6:74 et seq. BW [Dutch Civil Code]), in accordance with Article 82(2) AVG.

11.2. The Processor indemnifies the Controller against all claims of third parties, including data subjects, arising from an attributable failure of the Processor.

11.3. If both the Controller and the Processor are liable, they are jointly and severally liable towards the data subject for the full compensation, in accordance with Article 82(4) AVG. Between the Parties, the Processor holds the Controller harmless for the amount paid by the Controller to data subjects, insofar as the damage was caused by the Processor.

11.4. The Processor maintains at all times an adequate professional and liability insurance that provides cover for the liabilities under this Agreement and the AVG. Upon first request, the Processor shall demonstrate the existence of this insurance.

11.5. The general limitation of liability from the General Terms and Conditions (AW Art. 9) applies mutatis mutandis to this Agreement.

---

### Article 12 — Duration and Termination

12.1. This Agreement enters into force on the date of signature and applies for the duration of the main agreement between the Parties, unless they agree otherwise in writing.

12.2. The notice period of this Agreement is equal to the notice period of the main agreement.

12.3. The Controller may dissolve this Agreement at any time with immediate effect if:

(a) the Processor fails to comply with a material obligation under this Agreement or the AVG and is not able to remedy this failure within a reasonable period;
(b) the Processor is declared bankrupt, applies for suspension of payments (surseance van betaling), or a comparable procedure is instituted;
(c) the Controller objects to a Sub-processor and the Parties do not reach agreement.

12.4. After termination, Articles 3, 9, 10 (insofar as applicable to data already transferred), 11 and this Article 12 remain in force.

---

### Article 13 — Applicable Law and Dispute Resolution

13.1. This Agreement is governed by Dutch law. The applicability of the Weens Koopverdrag (CISG) [Vienna Sales Convention; UN Convention on Contracts for the International Sale of Goods] is excluded.

13.2. All disputes that may arise in connection with this Agreement shall, insofar as the law permits this, be submitted to the competent court in the arrondissement [judicial district] in which Rule Step B.V. has its statutory seat (Amsterdam).

13.3. Without prejudice to the provisions of this article, the data subject, in accordance with Article 79 AVG, has the right to bring legal proceedings before the competent court in the Member State of his habitual residence.

13.4. [B2C] For a Customer who is a Consumer, the additional forum-choice protections of AW Art. 16.2 apply (article 18(1) of Regulation (EU) No 1215/2012 (Brussels I bis), article 6:231 et seq. BW (Dutch Civil Code)).

---

### Article 14 — Final Provisions

14.1. Amendments and additions to this Agreement, including the Annexes, are only valid if these have been agreed in writing and signed by authorised representatives of both Parties.

14.2. If any provision of this Agreement is null or voidable, this leaves the validity of the remaining provisions unaffected.

14.3. Neither Party is authorised to transfer its rights and obligations under this Agreement to a third party without the prior written consent of the other Party.

---

### Signature

Thus agreed and signed in duplicate.

Place: Amsterdam, the Netherlands
Date: 30 September 2026

**FOR THE CONTROLLER:**
[Name controller]

Name: _______________________________________
Position: ____________________________________
Signature: ___________________________________

**FOR THE PROCESSOR (Rule Step B.V.):**

Name: J.J. van Grondelle
Position: Director (alleen/zelfstandig bevoegd [solely/independently authorised])
Signature: ___________________________________

---

### ANNEX A — Processing Specifications

This Annex A forms an integral part of the Data Processing Agreement and specifies the processing operations as referred to in the AVG (GDPR) (Article 28(3)(a)).

**A1. Purpose(s) of the processing:**

**Online services:**
- The management and hosting of IT infrastructure (web servers, VPSs, dedicated servers with hosting partners);
- The registration and management of domain names via the respective registrars (Realtime Register, TransIP, Gandi.net);
- The processing of customer data for invoicing and service management;
- The processing of payments and financial administration;
- The provision of technical service and customer service.

**Consulting (exclusively if and insofar as the Processor, in a concrete Assignment (Opdracht), processes personal data on behalf of the Controller):**
- Advising on data protection and information security;
- Analysing a customer database or another data file on behalf of the Controller;
- Assistance with personal data breaches, audits and requests from data subjects.

**A2. Categories of data subjects:**

**Online services:**
- Customers and contracting parties of the Controller (companies and natural persons);
- Employees and representatives of customers;
- Visitors and end users of the platforms and websites hosted by the Controller;
- Employees of the Controller.

**Consulting:**
- Data subjects within the meaning of the AVG whose personal data are provided by the Controller to the Processor in the context of the Assignment, as further specified in the Order Form or an annex.

**A3. Categories of personal data:**

- Identification data (first and last name, initials);
- Contact details (postal address, e-mail address, telephone number);
- Company data (company name, KvK number, position);
- Financial data (bank account numbers, invoice and payment history);
- Technical data (IP addresses, log files, device data, domain registration data such as WHOIS information);
- Authentication data (usernames, hashed passwords, MFA tokens);
- For consulting: the specific categories as further specified in the Order Form.

**A4. Special categories of personal data (Art. 9 AVG):**

The Parties have agreed that the processing within the framework of this Agreement does not relate to special categories of personal data. The Processor does not process personal data revealing race, ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union, genetic data, biometric data, health data, or data concerning a person's sexual behaviour or sexual orientation. If the Controller nevertheless provides such data, the Controller is exclusively liable for compliance with Article 9 AVG.

**A5. Scope of the processing:**

The processing comprises all operations that are necessary for the execution of the purposes mentioned in A1, including the collection, recording, organisation, structuring, storage, updating, modification, retrieval, consultation, use, transmission, dissemination, shielding, erasure and destruction of data.

---

### ANNEX B — Sub-processor List

This Annex B forms an integral part of the Data Processing Agreement and contains the current list of Sub-processors as referred to in Article 5 of the Agreement.

| Sub-processor Name | Category / Service | Country of establishment | Scope of processing / Purpose | Transfer outside EEA? |
| :--- | :--- | :--- | :--- | :--- |
| **Hosting partners (EU)** | Hosting / Infrastructure | Germany (EEA) and other EEA countries | Provision of dedicated servers and VPSs for data storage and processing. | No |
| **Realtime Register B.V.** | Domain registration | Netherlands (EEA) | Domain name registration and management, DNS hosting, WHOIS processing. | No |
| **TransIP B.V.** | Domain registration | Netherlands (EEA) | Domain name registration and management. | No |
| **Gandi SAS** | Domain registration | France (EEA) | Domain name registration and management. | No |
| **Proxmox Server Solutions GmbH** | Virtualisation / Infrastructure | Austria (EEA) | Server virtualisation management (Proxmox VE). | No |
| **Billing partner (per assignment)** | Billing / Automation | Determined per assignment | Customer management, invoicing, service automation (SCCs + TIA required in case of transfer outside EEA). | If outside EEA |
| **ICANN** | Domain registration (Management) | United States (Third country) | Global domain name management and WHOIS data exchange (SCCs + TIA; ICANN is **not** certified under EU-US DPF). | Yes |
| **SIDN (Stichting Internet Domeinregistratie Nederland)** | Domain registration (.nl) | Netherlands (EEA) | Validation and registration of .nl domain names. | No |
| **Payment processor (per assignment)** | Payment processing | Netherlands/EU | Processing of financial transactions and payments from customers. | No (provided EU processor) |

*Note:* For consulting assignments, no additional sub-processors are engaged above the list stated above, unless expressly agreed in the Order Form. If new Sub-processors are added, the Processor will provide a notification in accordance with Article 5.2 of the Agreement.

---

### ANNEX C — Security Measures (Technical and Organisational Measures — TOMs)

This Annex C forms an integral part of the Data Processing Agreement and specifies the measures as referred to in Article 4 and Article 32 AVG.

**C1. Encryption at-rest (Art. 32(1)(a) AVG):**
- All storage volumes, VPSs and dedicated servers that contain Personal Data make use of full-disk encryption (FDE) with AES-256.
- Back-ups are likewise stored encrypted with AES-256 before these are written to the storage location.
- Key management is strictly separated from the data storage, with regular rotation of encryption keys.

**C2. Encryption in-transit (Art. 32(1)(a) AVG):**
- All data transfers over networks are only permitted over encrypted connections with a minimum of TLS 1.2 or higher.
- Support for outdated protocols (SSL, TLS 1.0, TLS 1.1) is completely disabled.
- Internal server-to-server communication within the infrastructure is likewise encrypted (mTLS).

**C3. Access control — RBAC (Art. 32(1)(b) AVG):**
- Implementation of strict Role-Based Access Control (RBAC) at all system levels.
- Access rights are granted on the basis of the 'least privilege' principle.
- Periodic (at least annual) reassessment of access rights by the Information Security Officer (ISO) of the Processor.

**C4. Multi-factor authentication (MFA) (Art. 32(1)(b) AVG):**
- MFA is mandatory for all access to management interfaces (Proxmox, SSH, server control, registrars).
- Only hardware tokens or TOTP-based authenticator apps are permitted as second factor; SMS is excluded.

**C5. Incident response (Art. 32(1)(d) AVG):**
- The Processor has a formal Incident Response Plan (IRP) that is tested at least annually via tabletop exercises.
- 24/7 monitoring of the infrastructure (SIEM and IDS/IPS).
- Clear escalation procedures with defined response times (see SLA Art. 6).

**C6. Pseudonymisation (Art. 32(1)(a) AVG):**
- Where technically and functionally feasible, directly identifying data are separated from processing logic and replaced by pseudonyms.
- The key to reverse the pseudonyms is cryptographically secured and stored physically/logically separated.

**C7. Data segregation (Art. 32(1)(b) AVG):**
- Logical isolation (VLANs, firewalls, hypervisor isolation in Proxmox) between the environments of different customers/Controllers.
- Data of the Controller are strictly separated from the Processor's own business data.

**C8. Business continuity and back-ups (Art. 32(1)(b) and (c) AVG):**
- Daily automated back-ups according to the 3-2-1 rule.
- Back-ups are stored in a geographically separated data centre within the EEA.
- Monthly test execution of back-up restore procedures.

**C9. Regular testing and evaluation (Art. 32(1)(d) AVG):**
- Annual penetration tests (by an independent third party) on the external interfaces of the infrastructure.
- Continuous automatic vulnerability scans; critical vulnerabilities (CVSS > 7.0) are patched within 48 hours.
- Annual audit of the technical and organisational measures by the DPO/ISO of the Processor.

---

*For questions about this Data Processing Agreement: privacy@rulestep.com*