Nearwell data processing agreement

Version of 13 November 2026.

This data processing agreement belongs to the agreement for the use of Nearwell (the service) between:

• the user who uses the service for their work or business (the controller), and
• SilentPixel V.O.F., registered with the Dutch Chamber of Commerce (KVK) under number 42200581, Jan Luykenlaan 332, 3842 LS Harderwijk, the Netherlands (the processor).

Article 1. Subject and roles

1. The controller decides about which people they record data in the service, what that data is and what for. The processor processes that data only to provide the service.
2. Terms from the General Data Protection Regulation (GDPR) have the same meaning in this agreement as in the GDPR.
3. Annex 1 describes the processing, Annex 2 the subprocessors and Annex 3 the security.
4. For the user's own data, such as their account and settings, the processor is itself the controller. The privacy statement of the service applies to that data.

Article 2. Instructions

1. The processor processes personal data only on the documented instructions of the controller. The agreement, this data processing agreement and the use of the service's functions count as those instructions.
2. The processor creates, changes, merges or sends nothing on the controller's behalf unless the controller instructs it to in the service itself. The processor never contacts the people whose data has been recorded.
3. The processor does not use the data for its own purposes, for statistics or profiling, or to train artificial intelligence models.
4. If the processor must process data because a legal obligation requires it, the processor says so beforehand, unless the law forbids that.
5. If the processor finds that an instruction infringes the GDPR, the processor says so at once.

Article 3. The user's responsibility

1. The controller ensures that there is a lawful basis for the data they record in the service, and that the people concerned are informed where the GDPR requires it.
2. The service is not meant for special categories of personal data. The controller does not record them, in notes either, unless they have a lawful basis and an exception under the GDPR for it.

Article 4. Confidentiality

The processor ensures that everyone who has access to the data on its behalf is bound to confidentiality. Access is used only as far as needed to provide the service, to resolve a fault or misuse, or to answer a question from the user.

Article 5. Security

The processor takes appropriate technical and organisational measures as referred to in article 32 GDPR. Annex 3 describes them. The processor may change them, as long as the level of security does not fall.

Article 6. Subprocessors

1. The controller gives general authorisation for the subprocessors in Annex 2.
2. The processor announces a new or replacement subprocessor at least thirty days beforehand, by email to the account's address. If the processor hears of a change at a subprocessor later than that, it announces the change as soon as it hears of it.
3. The controller may object on reasonable grounds within that period. If the parties cannot agree, the controller may end the agreement before the change takes effect.
4. The processor imposes the same obligations on subprocessors as this agreement contains, and remains liable to the controller for their performance.

Article 7. Assisting the user

1. The controller can view, correct, export and delete data in the service itself, and answers requests from data subjects that way. If the processor receives such a request directly and it names the controller, the processor passes it on and does not answer it itself. The processor does not search users' data to find out who recorded someone.
2. The processor responds to a request for assistance within one month.
3. The processor assists, as far as reasonable and with the information the processor has, with a data protection impact assessment and a prior consultation of the supervisory authority.

Article 8. End of the agreement

1. Until the agreement ends, the controller can export the data as described in the service's terms.
2. The agreement ends when the controller deletes their account, or when the processor deletes the account because it has not been used for 24 months and the controller has not signed in within thirty days of an email about it. The processor then deletes the personal data from the database and storage at once, and from backups within the period in Annex 3, unless a legal obligation to retain applies. The processor confirms the deletion on request.
3. Email sending records (address, subject and status) stay with the email supplier in Annex 2 for that supplier's own retention period. The subject contains no personal data of anyone other than the user.

Article 9. Personal data breaches

1. The processor reports a personal data breach without undue delay and no later than 48 hours after discovering it, by email to the account's address.
2. The report describes, as far as known, what happened, which data and data subjects it affects, the likely consequences and the measures taken. What is not yet known follows as soon as it is.
3. Notifying the supervisory authority and the data subjects is the controller's task.

Article 10. Transfers outside the EEA

1. The database, the photos and the application are in the EU (Annex 2).
2. Vercel and Supabase are established outside the EEA. Their staff may access data, for example for support and operations, from the countries in Annex 2. That transfer rests on the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914), which are part of their data processing agreements.
3. Any other transfer outside the EEA happens only on a valid basis under chapter V of the GDPR.

Article 11. Audits

1. On request, the processor provides the information needed to demonstrate that this agreement is complied with.
2. The controller may have an audit carried out, at most once a year and with at least thirty days' notice, or sooner after a data breach or when a supervisory authority requires it. An auditor is bound to confidentiality. The controller bears the costs.

Article 12. Term, liability and precedence

1. This agreement applies as long as the processor processes personal data for the user.
2. Liability is governed by the processor's general terms and conditions.
3. In case of conflict, this agreement prevails as regards the processing of personal data.
4. This agreement is governed by Dutch law.

Annex 1. The processing

• Purpose: providing the service: keeping track of who the user knows, what was discussed, which tasks are open and when they want to talk to someone again, and emailing them about that daily when they ask for it.
• Data subjects: the people the user records in the service, such as clients, business contacts, colleagues and acquaintances.
• Data: name, company, job title, email address, phone number, links to profiles, where the user knows someone from, the strength of the relationship as the user chooses it, category, tags, notes, a photo, interactions with type, date and note, tasks, the preferred number of days between contact, and possible work with a stage, an estimated value and a note.
• Special categories: the service does not ask for them (article 3(2)).
• Retention: until the user deletes the data or their account.

Annex 2. Subprocessors

Annex 3. Security

• Each account is separated from other accounts in the database, at row level, and this is tested for each table.
• The application itself has no read rights on the tables: every database query runs as the signed-in user. Only sending the daily email and deleting unused accounts happen without a signed-in user, through narrowly scoped functions that return only a user's email address and language, and nothing about others.
• The key that reaches storage outside a user is used for one thing only: removing the photos of an account that has already been deleted.
• Traffic runs over HTTPS.
• Passwords are at least ten characters and are stored only as a hash. An email address is confirmed before the account works.
• Photos are stored in a folder per account, are reduced in size and stripped of metadata in the browser, and are checked again on the server.
• The application writes no names, addresses or content of data in its logs, and does not put them in a page's address: not even what the user searches for.
• Pages with data are not stored by a browser or intermediary, and a strict Content Security Policy limits which scripts may run.
• Backups: there are none. What the user deletes is gone everywhere at once.