NewU Data Processing Agreement
This Data Processing Agreement governs the processing of personal data between NewU and the Organisation in respect of the processing activities in which NewU acts as a processor. It forms a standard and integral part of the Agreement and is concluded simultaneously therewith.
This agreement applies to personal data that NewU processes on behalf of the Organisation. It does not apply to processing operations for which NewU acts as an independent controller; such processing operations are governed by the Privacy Policy.
For the sake of readability, this document uses the term “Organisation” to refer to the Licensee as defined in the General Terms and Conditions of Sale.
Article 1 - Definitions
1.1 Terms defined in the General Terms and Conditions of Sale shall have the same meaning in this Data Processing Agreement. “Organisation” refers to the Licensee as defined therein. In addition, the following definitions shall apply:
1.2 Data Processing Agreement: this agreement, including its annexes.
1.3 GDPR: Regulation (EU) 2016/679, the General Data Protection Regulation.
1.4 Data Subject: an identified or identifiable natural person whose personal data are processed by NewU on behalf of the Organisation.
1.5 Data Breach: a personal data breach within the meaning of Article 4(12) GDPR.
1.6 Sub-processor: a third party engaged by NewU that processes personal data in the context of this Data Processing Agreement.
1.7 Privacy Policy: The current privacy policy of NewU, in which NewU informs data subjects of the processing operations for which NewU acts as an independent controller, available via https://www.newu-app.io/en/privacy-policy.
Article 2 - Subject matter and scope
2.1 This Data Processing Agreement applies to the processing operations in which NewU acts as a processor on behalf of and on the instructions of the Organisation. These processing operations, including their nature, purpose, the types of personal data and the categories of Data Subjects, are described in Annex 1.
2.2 The processing operations for which NewU acts as a processor are set out in Annex 1, Part A and fall within the scope of this Data Processing Agreement. Processing operations for which NewU itself determines the purposes and means of the processing do not fall within the scope of this Data Processing Agreement. For such processing operations, NewU acts as an independent controller and informs Data Subjects thereof by means of the Privacy Policy.
2.3 This Data Processing Agreement shall remain in force for the term of the Agreement and shall terminate by operation of law upon termination thereof.
Article 3 - Instructions and lawfulness
3.1 NewU shall process personal data falling within the scope of this Data Processing Agreement solely on the instructions of the Organisation. The following shall in any event constitute instructions: the Agreement, this Data Processing Agreement, the configuration recorded by the Organisation in the Portal, the data it uploads to the Portal or makes available to NewU via an integration, and any other directions it provides to NewU in a reproducible manner. Instructions may be given electronically, in accordance with Article 28(9) GDPR.
3.2 NewU shall inform the Organisation without undue delay if, in NewU’s opinion, an instruction infringes the GDPR or other data protection provisions.
3.3 The Organisation, as controller, warrants that its instructions and the personal data supplied by it are lawful and that a valid legal basis exists for the processing.
Article 4 - Confidentiality
4.1 NewU shall ensure that persons who have access to personal data under its responsibility are bound by confidentiality, whether pursuant to a statutory obligation or pursuant to a contractual obligation.
4.2 The confidentiality obligation with respect to personal data shall apply without limitation in time, in accordance with Article 11.4 of the General Terms and Conditions of Sale.
Article 5 - Security
5.1 NewU shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. The security measures applicable to the processing operations to which this Data Processing Agreement applies are set out in Annex 3. The Privacy Policy contains information on the security measures applied by NewU to the independent processing operations for which it acts as controller.
Article 6 - Sub-processors
6.1 The Organisation grants NewU general authorisation to engage Sub-processors. The current Sub-processors are listed in Annex 2.
6.2 NewU shall inform the Organisation at least 14 days prior to the engagement of any new or replacement Sub-processor. Within this period, the Organisation may object in writing, stating its reasons, on compelling and demonstrable data protection grounds.
6.3 In the event of a well-founded objection, NewU shall seek an alternative or additional safeguards within thirty days. If this is not reasonably possible and the Sub-processor is necessary for a part of the Service, the Organisation may terminate the Agreement solely in respect of that part with effect from the date of engagement. Fees already paid shall not be refunded.
6.4 NewU shall impose on Sub-processors obligations at least equivalent to those set out in this Data Processing Agreement. NewU shall remain fully liable to the Organisation for the acts of its Sub-processors.
Article 7 - Rights of Data Subjects
7.1 NewU shall provide the Organisation with reasonable assistance in responding to requests from Data Subjects pursuant to Articles 12 to 22 GDPR, insofar as such requests relate to processing operations falling within the scope of this Data Processing Agreement.
7.2 A request submitted by a Data Subject directly to NewU shall be handled by NewU if it concerns a processing operation for which NewU acts as an independent controller. If the request concerns a processing operation under this Data Processing Agreement, NewU shall forward the request to the Organisation without delay and shall provide the Organisation with the assistance referred to in Article 7.1.
Article 8 - Data Breaches
8.1 NewU shall inform the Organisation without undue delay after becoming aware of a Data Breach affecting processing operations under this Data Processing Agreement, and in any event within 48 hours of becoming aware thereof. Insofar as not all information is available at the time of the initial notification, NewU shall provide the additional information as soon as possible after it becomes available.
8.2 The notification shall contain at least the information the Organisation requires in order to comply with Articles 33 and 34 GDPR, including the nature of the Data Breach, the categories and approximate number of Data Subjects concerned, the likely consequences and the measures taken or proposed.
8.3 NewU shall provide reasonable assistance with notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and, where necessary, to Data Subjects.
8.4 For processing operations under this Data Processing Agreement, notification to the Dutch Data Protection Authority and to Data Subjects is the responsibility of the Organisation.
Article 9 - Assistance with DPIAs and prior consultation
9.1 NewU shall provide the Organisation with reasonable assistance in carrying out a data protection impact assessment (DPIA) and in the prior consultation of the Dutch Data Protection Authority, insofar as these relate to processing operations under this Data Processing Agreement.
9.2 NewU may charge a reasonable fee for work that goes substantially beyond the standard services. It shall inform the Organisation thereof in advance.
Article 10 - Audit and right to information
10.1 NewU shall make available to the Organisation the information necessary to demonstrate compliance with the obligations under Article 28 GDPR and this Data Processing Agreement.
10.2 NewU is certified in accordance with ISO/IEC 27001:2022 and has an annual penetration test carried out by an independent firm. Upon request, NewU shall make available a summary of the most recent audit results.
10.3 If the reports referred to in Article 10.2 provide insufficient assurance regarding compliance with this Data Processing Agreement, the Organisation may have an audit or inspection carried out by itself or by an independent auditor mandated by it, subject to the following conditions:
a. the audit shall be carried out by an independent auditor with appropriate expertise who is subject to appropriate confidentiality obligations;
b. the Organisation shall announce the audit in writing in advance and shall reasonably agree the scope, method and timing thereof with NewU; NewU may impose reasonable conditions where this is necessary for security, confidentiality or business continuity;
c. the scope shall be limited to compliance with this Data Processing Agreement in respect of the Organisation itself; access to data or systems affecting other customers of NewU is excluded, unless this is strictly necessary and appropriate safeguards have been put in place;
d. the Organisation shall bear its own audit costs. Reasonable costs of NewU agreed in advance for necessary cooperation with the audit may be charged separately, provided that such costs are not disproportionate or prohibitive.
Article 11 - Transfers outside the EEA
11.1 NewU processes and stores personal data within the European Economic Area, as further described in the Privacy Policy.
11.2 Transfers outside the EEA shall take place only where appropriate safeguards within the meaning of Chapter V GDPR have been put in place, such as standard contractual clauses adopted by the European Commission.
Article 12 - Liability
12.1 The liability of the Parties under this Data Processing Agreement shall be governed by the liability provisions of the General Terms and Conditions of Sale. The current version of the General Terms and Conditions of Sale can be consulted via www.newu-app.io/en/general-conditions-of-sale.
Article 13 - Term and termination
13.1 This Data Processing Agreement shall enter into force simultaneously with the Agreement and shall terminate by operation of law upon termination of the Agreement.
13.2 Upon termination of the Agreement, the Organisation shall choose whether NewU is to return or delete the personal data. If the Organisation chooses deletion, NewU shall delete the personal data within twenty days of termination, unless a statutory retention obligation precludes this.
13.3 The deletion of data in accordance with Article 13.2 applies to the personal data of invited employees who have not activated a personal account. From the moment an employee accepts the End User Terms and Conditions and activates his or her personal account, NewU processes the account data as an independent controller for its own purposes as described in the Privacy Policy. Such processing operations fall outside the scope of Article 13.2, and the personal account shall be managed in accordance with the Privacy Policy, including the retention periods and deletion rights set out therein.
Article 14 - Amendments
14.1 Each version of this Data Processing Agreement bears a version number and an effective date.
14.2 NewU shall inform the Organisation of substantive amendments in good time. A material amendment that adversely affects the rights or obligations of the Organisation shall require the Organisation’s consent.
14.3 The current version and an archive of previous versions are available via the NewU website.
14.4 This Data Processing Agreement was originally drawn up in Dutch. NewU may make translations available in other languages. In the event of any discrepancy between the Dutch text and a translation, the Dutch text shall prevail.
Article 15 - Order of precedence and governing law
15.1 This Data Processing Agreement is governed by Dutch law. Disputes shall be settled by the competent judge of the District Court of Amsterdam (Rechtbank Amsterdam).
15.2 In the event of any conflict regarding the processing or protection of personal data, this Data Processing Agreement shall prevail over the Agreement and the General Terms and Conditions of Sale, in accordance with the order of precedence set out in the General Terms and Conditions of Sale.
15.3 Provisions which by their nature are deemed to survive termination shall remain in force, including in any event the provisions concerning confidentiality, liability and governing law.
Annex 1 - Table of roles and processing operations
The allocation of roles is determined for each separate processing activity. The table below is binding.
A. Processing operations for which NewU is the processor and the Organisation is the controller (falling within the scope of this Data Processing Agreement)
| Element | Description |
|---|---|
| Product or service | Management of the employee file and the creation and management of users |
| Subject matter and nature | Receiving, recording, structuring, storing, updating, using, transferring to authorised Sub-processors and deleting the employee file supplied by the Organisation. |
| Purposes | Creating and managing users on behalf of the Organisation, sending invitations and reminders on behalf of the Organisation, preparing access to the Service, assigning users to groups on the basis of the user attributes recorded by the Organisation so that group results can be displayed per group, granting and managing administrative rights, and sending functional service communications. |
| Categories of Data Subjects | Employees, self-employed contractors and other persons designated by the Organisation to use NewU. |
| Personal data | The Organisation itself determines which data it records, within the following categories: a. Basic data: name, business e-mail address and language preference. b. User attributes: characteristics chosen by the Organisation itself and assigned to users for group classification and filtering, such as department, position, location, manager, gender or date of birth. This category is not exhaustive. c. Administrative rights: the administrative role assigned by the Organisation to a user and the functions and groups to which that role relates. NewU determines which roles and rights are available; the Organisation determines to whom they are assigned. The Organisation shall not record special categories of personal data within the meaning of Article 9 GDPR, criminal data or the citizen service number (BSN) as an attribute. |
| Rights and obligations of the Organisation | The Organisation determines and documents the instructions, safeguards purpose limitation, legal basis, transparency, accuracy and data minimisation, and may request information, assistance, objection to Sub-processors, return, deletion and audits in accordance with this Data Processing Agreement. The Organisation determines which user attributes it records and warrants the necessity and lawfulness thereof. |
B. Other processing operations
The role of NewU is determined for each separate processing activity. For processing operations for which NewU itself determines the purposes and means, NewU acts as an independent controller. This includes in any event the personal account following registration, questionnaires, individual survey results and personal feedback, vitality functions, support, security and technical operation. These processing operations do not fall within the scope of this Data Processing Agreement and are further described in the Privacy Policy.
Where the Organisation engages an occupational physician or occupational health and safety service to provide occupational health care to its employees, NewU shall conclude with that party a separate Physician Portal Access Agreement setting out confidentiality, security and the conditions for access to individual survey results. The Organisation is not a party to that agreement. NewU shall provide individual results to the occupational physician or occupational health and safety service solely on the basis of the explicit consent of the employee concerned under Article 9(2)(a) GDPR.
Annex 2 - Sub-processors
The Sub-processors listed below have been engaged by NewU for the processing operations under this Data Processing Agreement.
| Sub-processor | Location | Purpose |
|---|---|---|
| Google Cloud Platform / Firebase | EEA (Frankfurt) | Data storage, hosting and infrastructure for the app, the Portal and the survey module |
| Brevo | EEA (France) | Sending functional and transactional e-mails, including invitations, reminders and service communications |
In addition, NewU uses processors for processing operations for which it acts as an independent controller. These are listed in the Privacy Policy.
Annex 3 - Security measures
NewU applies the following principles. For a more detailed description, NewU refers to the Privacy Policy and, upon request, to its information security policy.
- NewU is certified in accordance with ISO/IEC 27001:2022 and maintains a fully implemented information security management system (ISMS). NewU’s ISMS shall be made available upon request.6
- Personal data are encrypted, both at rest and in transit.
- Access to personal data is granted exclusively on the basis of role and necessity, in accordance with a no-access-by-default policy.
- NewU has an annual penetration test carried out by an independent, ethical and specialised firm.
