Version: p100-os89-2026-10-05-v1 · Language: EN-GB · Document ID: dpa.
This agreement and Annexes I–IV form part of the accepted product-100 / Managed OS 89 Order. The Order identifies the customer and authorised contacts. The processor is Maarten Strootman, trading as Novasean under Straeder, KVK 42050491, Karekietstraat 18, 1431 WP Aalsmeer, Netherlands; contact support@novasean.com. This agreement does not itself execute a downstream supplier contract or an international-transfer mechanism.
1. Roles, scope and instructions
For personal data hosted or handled on your behalf to deliver this VM, OS management, support and backup, you act as controller, or as a processor authorised by your controller client. Novasean acts as processor or subprocessor respectively. A customer acting as processor must have authority to instruct us and appoint us in its controller chain. Your rights and obligations include choosing lawful purposes, providing lawful instructions, informing data subjects, managing customer application access and exercising the oversight and audit rights below.
The Order, these agreed annexes and your authorised written instructions are the documented instruction set. We process only on those instructions, including for transfers, unless Union or Member State law binding on us requires otherwise; where lawful, we tell you before compelled processing. We immediately tell you if we consider an instruction to infringe the GDPR or other Union or Member State data-protection law and resolve the issue before the affected processing proceeds. There is no authority for advertising, sale of customer data, external model training or another independent use.
Novasean separately controls its own account, billing, abuse-prevention, security and statutory business records where it determines the purpose and means. That distinct processing is subject to applicable privacy information and law and is not converted into processor activity merely by this agreement. Customer workload data and customer-controlled support evidence remain within this DPA when handled for your service.
2. People and security
We must ensure that authorised people are bound by confidentiality or an appropriate statutory duty and receive only the access their task needs. We implement and maintain appropriate Article 32 technical and organisational measures, taking account of the risks, nature, scope, context, purposes, state of the art and costs. Annex II states the evidenced service baseline and binding handling requirements; it does not represent untested features as verified.
We must maintain confidentiality, integrity, availability and resilience appropriate to the processing, the ability to restore access in a timely manner after an incident and a process to assess the effectiveness of security measures. The lack of a contractual recovery-time SLA does not remove those statutory duties. Security changes must not unlawfully lower protection; material changes affecting you are communicated. You remain responsible for the customer-controlled application and root-access configuration.
3. Assistance, breaches and audits
Taking account of the processing, we assist you through appropriate measures, insofar as possible, with GDPR Chapter III rights requests. We promptly forward a request about your controlled data and do not determine the response independently unless authorised or legally required. Taking account of the information available, we assist with Articles 32–36 security, breach assessment/notification, impact assessments and prior consultation. Separately agreed reasonable assistance charges must not defeat a statutory right or excuse a legally required response; ordinary breach notification and necessary information are not conditional on a new purchase.
We notify the authorised Order contact without undue delay after becoming aware of a personal-data breach affecting your data. We provide available information on its nature, affected categories and approximate numbers where possible, the responsible contact, likely consequences and measures taken or proposed, including mitigation. Information may follow in phases without undue further delay. We preserve relevant evidence, contain and recover appropriately and cooperate. We do not wait for a completed investigation. The controller's potential 72-hour authority-notification period is not an allowance for us to delay notification to you. Operational questions and your incident reports use support; the proprietor is accountable for DPA escalation. We arrange a secure exchange where detailed evidence is needed.
We make available all information needed to demonstrate Article 28 compliance and allow and contribute to audits, including inspections, by you or your mandated auditor. Proportionate arrangements may protect confidentiality, security and other customers but must not frustrate effective oversight, urgent access or a regulator's powers. No certification, report, prohibitive fee or absolute frequency limit automatically replaces those rights. We remedy deficiencies within our responsibility and provide relevant results.
4. Subprocessors and international access
You give specific written authorisation for the named activities in Annex III, subject to its express conditions. No unnamed processing recipient is authorised. We must impose substantively equivalent data-protection obligations through a binding downstream arrangement before a subprocessor handles your data, including sufficient security guarantees. We remain fully liable to you for performance of its data-protection obligations.
For a proposed addition, replacement or material new processing/access location, we give at least 30 calendar days' durable advance notice stating the recipient, role, data, locations and safeguards. You may object on reasoned data-protection grounds during that period. We must resolve the objection, use a satisfactory alternative or refrain from the disputed processing. If continuation cannot reasonably be arranged, you may terminate the affected service without an extra termination fee and receive prepaid unused charges proportionately. A website edit alone is not authorisation. A compulsory urgent change must follow law and protect your rights rather than silently bypass this process.
Third-country access must comply with your instructions and GDPR Chapter V before it starts. Annex IV specifies the contemplated Pakistan route and its unexecuted status. A Netherlands VM and same-datacentre backup do not mean all processing stays in the EEA. We must identify and assess the actual exporter/importer, route and safeguards, execute applicable unmodified transfer clauses with completed annexes where used, and apply effective supplementary measures. This DPA is not an SCC signature or an adequacy decision.
For authority requests we validate the demand, seek clarification or challenge where legally warranted, minimise disclosure and inform you unless prohibited. We do not disclose merely because an unverified request has arrived. Mandatory SCC precedence and safeguards apply where transfer clauses are used.
5. Return, deletion, duration and precedence
At your choice we return or delete your personal data after processing services end and delete existing copies unless Union or Member State law requires storage. Annex I and the schedule give the practical retrieval/deletion sequence and bounded residual backup period. Residual copies remain protected and unused for unrelated purposes. We reapply applicable deletion instructions after an older copy is restored, identify legally required retention and provide appropriate completion information on request. A generic backup exception cannot justify indefinite retention.
The DPA continues while we retain your personal data. It prevails over inconsistent service terms; valid SCCs retain their precedence. Nothing limits data-subject rights, regulator powers, Article 82 liability or other mandatory obligations. Each party remains responsible for its legal duties.
Annex I — Service processing details
| Item | Agreed scope |
|---|---|
| Subject and duration | One product-100 / Managed OS 89 VM; hosting, OS operation, support, security, monitoring, VM backup, restoration and exit for the service term, retrieval period and bounded residual retention below. |
| Nature and purpose | Storage and transmission of workload data on virtual disks; task-limited access for OS maintenance, diagnosis, support and security; VM snapshots, restoration, retrieval and deletion. No independent advertising or training use. |
| Data types | Ordinary customer-controlled names, contact/account identifiers, application user records, business communications/files and technical logs or network identifiers within the lawful workload; sanitised support and diagnostic information where needed. Credentials are used only for authorised access and must not be included unnecessarily in support evidence. |
| Data subjects | Your staff, contractors, customers, contacts and authorised application users whose ordinary data you lawfully place in this service. |
| Excluded data | Medical personal data. Other special-category or criminal-offence data need a specifically agreed lawful scope and safeguards before submission; they are not authorised by this standard annex. |
| Customer role and instructions | The Order's business customer acts as controller, or confirms that it is a processor authorised by its controller. The selected standard workload categories above form the initial instructions; a materially different category requires an agreed variation before processing. No live records or samples need be placed in the Order. |
| Primary and backup location | Netherlands VM on Novasean's Proxmox platform at Worldstream in Naaldwijk; existing PBS in the same datacentre as the cluster. No included off-site copy. |
| Administrative access | Novasean's proprietor in the Netherlands; contemplated independent operator access from Pakistan only subject to Annexes III–IV. Third-country access is not authorised merely because technical access exists. |
| Retention during service | Customer-controlled workload retention in the live VM; daily backup with 3 most recent / 7 daily / 4 weekly / 6 monthly retention settings, whose tiers may overlap. Support/diagnostic data must be minimised and retained only as needed for the instructed task and accountability. |
| Exit instruction | You choose return or deletion. The schedule provides at least 30 calendar days' retrieval after transition. Active service copies and unnecessary access are removed after retrieval or an express lawful earlier instruction. Residual snapshots are isolated from routine use and expire within six calendar months after service end; an earlier deletion instruction must be addressed with an appropriate method. Restored copies have deletion instructions reapplied. Statutory retention is separately identified. |
| Contacts | Your authorised Order service/incident contact and Novasean support@novasean.com; DPA escalation to Maarten Strootman at the stated correspondence address. |
Annex II — Measures and their evidence boundary
The service uses a Proxmox VM, replicated SSD and the same-datacentre PBS arrangement described in the schedule. Existing-platform backup and restore, including new VPS inclusion, are relied upon as the proprietor's expressly accepted operating assumptions; this is not a claim of a new synthetic restore test or an independently verified customer snapshot.
The bounded technical evidence returned for first-unit preparation includes TLS certificate verification on the provider API, pinned SSH host keys for administrative connections, and root-owned configuration/control files for the provisioning safeguards. These describe that path; they do not establish that every account or network has MFA, universal encryption at rest, tenant isolation certification or 24/7 security observation. Novasean claims none of those features through this annex.
For this processing Novasean must apply task-limited privileged access; confidential, secure credential exchange and storage; removal of access no longer needed; documented material changes and exceptions; scheduled OS updates with a human exception owner; sanitised support records; the incident escalation and notification duties above; the included backup/recovery operation; and the exit/deletion instructions. An external operator must meet these obligations through the downstream agreement before processing. The customer maintains its own application users, licences and security configuration. Material workload risks or different data categories must be assessed before scope changes. These are binding handling requirements, not a representation of a completed independent security audit or certification.
Annex III — Named infrastructure and contemplated subprocessing
| Recipient | Role, location and limits | Authorisation and downstream status |
|---|---|---|
| Novasean: Maarten Strootman trading under Straeder | Processor operating the VM, Proxmox platform and included PBS; Netherlands. | Party to this DPA, not a separate subprocessor. |
| Worldstream B.V. | Named infrastructure/datacentre supplier; primary platform at Worldstream in Naaldwijk, Netherlands. The proprietor identifies this actual platform location; Worldstream's public privacy statement identifies Worldstream B.V. as a Netherlands company. No guest-OS or workload-support access is granted by this row. | You authorise its infrastructure activity to the extent it entails processing on your behalf. Novasean must ensure applicable downstream obligations for any such processing. This row does not represent that a separate signed supplier DPA has been produced or extend authorisation to an unidentified affiliate, remote-support party or overseas storage. |
| Abdul Sami, independent freelancer based in Pakistan | Contemplated task-limited Managed OS administration, monitoring exception handling and VM recovery; remote access from Pakistan may expose ordinary workload data and logs. No unrelated use or onward subcontractor is authorised. | You authorise this named appointment only once his contracting identity is confirmed, binding equivalent processing/confidentiality terms are effective and Annex IV's transfer safeguards are effective. Those arrangements are pending at preparation of this version. Until then, Novasean must exclude his access to your personal data; this is not evidence that access has already been restricted or an agreement signed. |
No other processor or backup destination is authorised under this version. Supplier appointment remains Novasean's responsibility. Your authorisation does not waive the required downstream obligations or transfer safeguards. Materially different identity, recipient, purpose or access location needs the authorisation process above.
Annex IV — Pakistan access and transfer safeguards
The contemplated route is Novasean as EEA processor/exporter making customer personal data available to Abdul Sami as a separate independent processor/importer in Pakistan for the limited Annex III tasks. This is treated as a restricted transfer, rather than the internal processing of an employee. Storage can remain in the Netherlands while remote viewing constitutes making data available abroad.
There is no executed transfer mechanism evidenced by this version. No Pakistan transfer may start merely on customer assent to this DPA. Before that access, Novasean and the actual importer must complete and execute the appropriate transfer instrument and its annexes, assess destination laws/practices and access risks, and implement effective supplementary measures. The prepared route is the European Commission Decision (EU) 2021/914 processor-to-processor Module 3 where its scope conditions apply. If the importer's relevant processing is directly subject to the GDPR in a way outside that instrument's scope, Novasean must use an applicable lawful mechanism; the module is not adopted on an invented jurisdictional fact.
The separate downstream instrument must identify the limited purpose, ordinary data/people categories, confidentiality, remote-only task-limited access, no unauthorised local copies or onward recipients, incident reporting, audit cooperation, return/deletion, authority-request handling and the exact SCC choices. The pending importer identity, local-law assessment and signatures must be completed before personal-data access. That instrument is an obligation between Novasean and its importer, not a changing seventh document incorporated into your Order. If adequate safeguards cannot be provided, that access must not take place. You may obtain the effective appointment and transfer information needed to oversee your chain. A later public page cannot silently substitute a different importer or transfer.