Annex to the General Terms and Conditions of SimpliSoft B.V.
Parties
- The Client, as defined in article 2.7 of the General Terms and Conditions, acting as controller (the "Client"); and
- SimpliSoft B.V., Tokyostraat 19 M, 1175 RB Lijnden, the Netherlands, Chamber of Commerce number 96268735, acting as processor ("SimpliSoft"). Contact for this DPA: privacy@simplisoft.app.
1. Definitions and scope
1.1 Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). Other capitalised terms have the meaning given in the General Terms and Conditions ("General Terms").
1.2 Client Personal Data is the personal data SimpliSoft processes on behalf of the Client in providing the Portal, as described in Annex 1. A Sub-processor is a third party SimpliSoft engages, directly or through another Sub-processor, to process Client Personal Data.
1.3 This DPA forms part of the Agreement. Where it conflicts with the General Terms on the processing of personal data, this DPA prevails.
1.4 SimpliSoft is controller, and this DPA does not apply, only for user accounts, account security and sign-in, support, the audit log of the Portal, proof of acceptance of its terms, account and security emails, and concluding, managing and invoicing the Agreement. The Privacy Policy describes that processing. Names, email addresses and roles of users are Client Personal Data where they are used inside the modules.
1.5 A Connected System is the Client's own. Its provider is not a Sub-processor of SimpliSoft.
2. Subject matter, nature, purpose and duration
2.1 Subject matter and purpose. Hosting and processing Client Personal Data in the Portal modules the Client has enabled, solely to provide the Portal under the Agreement, including support, maintenance and security.
2.2 Nature. Storing, retrieving from and sending to Connected Systems on the Client's instruction (such as documents a customer uploads, or an action a user confirms in SimpliAgents), structuring, displaying, analysing, screening, sending messages on the Client's behalf, processing by AI models, backing up and deleting.
2.3 Data subjects and personal data. See Annex 1.
2.4 Special categories and criminal data. The Portal is not intended for special categories of personal data (article 9 GDPR), except a sick-leave registration in SimpliPeople, which holds only the fact that the employee is sick, the dates and the number of days; the Portal does not accept a reason, diagnosis or note with it. The Client is responsible for its legal basis for that registration (article 9(2)(b) GDPR with article 30(1)(b) of the Dutch GDPR Implementation Act, reintegration and guidance of sick employees) and shall not enter other such data anywhere in the Portal. Outside SimpliComply, the Portal is not intended for personal data relating to criminal convictions and offences (article 10 GDPR). Screening results in SimpliComply about natural persons can include such data, for example a hit on a list based on criminal offences. The Client ensures it has a legal basis for that processing, in sanctions and export-control law.
2.5 Duration. This DPA applies for as long as SimpliSoft processes Client Personal Data under the Agreement, and after that until the data has been deleted under article 10.
3. Instructions
3.1 SimpliSoft processes Client Personal Data only on the Client's documented instructions, including with regard to transfers outside the EEA, unless the law requires otherwise; in that case SimpliSoft informs the Client first, unless the law prohibits it.
3.2 The Client's instructions are the Agreement, including this DPA, and the Client's configuration and use of the Portal. An instruction that needs functionality the Portal does not have is a change request under article 4.6 of the General Terms.
3.3 SimpliSoft immediately tells the Client if, in its opinion, an instruction infringes data protection law.
3.4 The Client instructs SimpliSoft to keep a log of the questions, results and answers of the SimpliDash assistant, and the feedback on them, for 90 days. The log is used only to diagnose and fix answers for the Client, not to improve the service for other clients or to train models. SimpliSoft does not use this log for purposes of its own.
3.5 As controller, the Client determines the purposes of the processing, ensures it has a legal basis for the Client Personal Data and for its instructions, and informs the data subjects.
3.6 The Client instructs SimpliSoft to use Client Personal Data from the Client's Connected Systems in SimpliSoft's test environment, to test new and changed functions of the Portal before they are released. The test environment is protected by the measures of Annex 2, is accessible only to SimpliSoft staff and contractors bound by confidentiality and to users the Client gives access for testing, and does not send anything to the Client's Connected Systems. Email from the test environment goes only to SimpliSoft, except the emails for signing in (an invitation, a password reset or a sign-in link), which go to the user's own address and are marked as coming from the test environment. The Client may withdraw this instruction at any time; SimpliSoft then removes that data from the test environment within 30 days. At the end of the Agreement SimpliSoft also removes that data from the test environment.
4. Confidentiality
4.1 Everyone at SimpliSoft who can access Client Personal Data is bound by confidentiality.
4.2 SimpliSoft staff access Client Personal Data only where needed for support, maintenance, security or an incident.
5. Security
5.1 SimpliSoft takes appropriate technical and organisational measures as article 32 GDPR requires, including those in Annex 2. SimpliSoft may change these measures, provided the overall level of protection does not decrease.
5.2 The Client is responsible for its own side of the Portal, including whom it invites and what they may see, removing access that is no longer needed, the security of its own identity provider and Connected Systems, and the recipients it adds to notifications and reports.
6. Sub-processors
6.1 The Client gives SimpliSoft general written authorisation to engage Sub-processors. SimpliSoft keeps an up-to-date list of all its Sub-processors, including those a Sub-processor engages for the Portal (such as the screening and credit information providers engaged through SimpliSoft's compliance partner), with their name, location and what they do, and makes it available to the Client's administrators in the Portal or on request.
6.2 SimpliSoft notifies the Client's administrators by email of any intended addition or replacement of a Sub-processor at least 14 days before the change. Within that period the Client may object in writing, stating its reasons. If the parties find no solution, the Client may terminate the affected part of the service without penalty.
6.3 SimpliSoft binds each Sub-processor by contract, which may be the Sub-processor's standard terms, to data protection obligations as article 28(4) GDPR requires, and remains responsible to the Client for it, subject to article 13.
7. Transfers outside the European Economic Area
7.1 SimpliSoft stores Client Personal Data in the European Union.
7.2 Client Personal Data is transferred outside the EEA only where a Sub-processor is located there, and only under the safeguards of Chapter V GDPR: an adequacy decision of the European Commission or the Standard Contractual Clauses.
8. Assistance
8.1 The Client can access Client Personal Data in the Portal and correct or delete much of it itself; for the rest, SimpliSoft assists on request. If a data subject contacts SimpliSoft about Client Personal Data, SimpliSoft forwards the request to the Client.
8.2 Where the Portal's own functions are not enough, SimpliSoft reasonably assists the Client with data subject requests and with its obligations under articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to SimpliSoft. This assistance is at the Client's cost, at SimpliSoft's hourly rates under article 10.2 of the General Terms, except as set out in article 9.2.
9. Personal data breaches
9.1 SimpliSoft notifies the Client of a personal data breach affecting Client Personal Data without undue delay after becoming aware of it, with the information article 33(3) GDPR requires as far as then known.
9.2 SimpliSoft takes reasonable measures to contain the breach and assists the Client under article 8.2, free of charge where the breach is attributable to SimpliSoft or its Sub-processors. It does not notify the supervisory authority or data subjects on the Client's behalf unless the Client asks it to or the law requires it.
10. End of the Agreement
10.1 The Client chooses whether it wants its data returned before it is deleted. It can export its data with the Portal's export functions where available; otherwise SimpliSoft provides, on request, a database extract in a structured, commonly used and machine-readable format. Until 12 January 2027 SimpliSoft may charge its direct costs for the extract; after that date it is free.
10.2 After the end of the Agreement, including any transitional period under article 20 of the General Terms, the Client can retrieve its data for at least 30 days. SimpliSoft then deletes the Client Personal Data. Deleted data disappears from backups as they are replaced in the normal backup cycle.
10.3 Article 10.2 does not apply where the law requires SimpliSoft to keep data. On request, SimpliSoft confirms the deletion in writing.
11. Information and audits
11.1 SimpliSoft makes available the information needed to demonstrate compliance with article 28 GDPR. For Sub-processors, SimpliSoft meets audit requests by providing their current certifications or third-party audit reports, where available.
11.2 The Client may audit SimpliSoft's compliance with this DPA once per calendar year, and additionally where reasonably necessary after a personal data breach or a substantiated concern about compliance, with reasonable notice, itself or through an independent auditor bound by confidentiality. An audit starts with SimpliSoft providing documentation or answering a questionnaire; if the Client reasonably considers that insufficient, an inspection follows. An audit does not disrupt the Portal and gives no access to other clients' data. The Client bears the audit and pays SimpliSoft's reasonable costs. A supervisory authority may audit under its own powers.
12. Client-specific arrangements
12.1 Where SimpliSoft processes personal data for a particular Client in a way this DPA does not describe, the parties record this in a client-specific annex (Annex 3). For that Client, Annex 3 prevails where it deviates.
13. Liability, term and governing law
13.1 Liability under this DPA is subject to article 13 of the General Terms. That limitation applies only between the parties and does not affect either party's liability towards data subjects under article 82 GDPR, administrative fines (which each party bears itself), or liability that cannot be limited by law.
13.2 This DPA ends when the Agreement ends, except for obligations that by their nature continue, in particular articles 4 and 10.
13.3 SimpliSoft may update Annex 2 under article 5.1 and its list of Sub-processors under article 6. Other changes require the written agreement of both parties.
13.4 This DPA is governed by Dutch law. Disputes go to the court designated in article 15.2 of the General Terms.
Annex 1: Data subjects and personal data per module
What SimpliSoft holds for a Client depends on the modules it has enabled and the Connected Systems it has connected.
| Module | Data subjects | Personal data |
|---|---|---|
| All modules | The Client's users and Invited Users | Name, email, role and access settings as used inside the modules (account security, sign-in and the audit log: article 1.4) |
| SimpliDash, SimpliOps, SimpliLog | The Client's staff; contact persons named in shipment data | Shipment data from the Client's Connected Systems (including shipper and consignee names and addresses), staff assignments, notes and tasks, finance data if connected, assistant log and feedback (article 3.4), report recipients |
| SimpliTrack | Users at the Client's customers and the recipients they add; customers, shippers and consignees named in shipment data | Shipment data including customer, shipper and consignee names (which can be natural persons), customer accounts and users (name, email, access settings, last sign-in), notification and report settings with recipient addresses, followed shipments, an invoice index, a log of document downloads and uploads |
| Screens (optional function, if the Client uses it) | The Client's staff and contact persons named in shipment data, tasks or calendar appointments shown on a screen | What the Client's administrator puts on a screen from the modules above (shipment data, task texts, figures), the time, title and location of appointments from a calendar the Client published itself, and for a paired device a short description of its browser, the size of its picture and when it last reported in. A screen is shown without sign-in to whoever holds its link or stands in front of the paired device; the Client decides what is on it and where it hangs |
| SimpliAgents (optional module, if the Client uses it) | The Client's users; anyone named in a conversation, document or connected source; senders of mail in a mailbox the Client connected | Agent instructions, conversations, text from voice messages, attached documents and websites, usage, a record of actions carried out through connections; the proposals an agent makes on a schedule or on an event and the decisions on them; mail received in a Microsoft 365 mailbox the Client connected (sender, subject, text), read only |
| SimpliComply | Contact persons and directors of the Client's business partners; the Client's staff and auditors; people who submit an incident report; users of the partner who assists with screenings | Screenings and results (names, addresses, countries, registration numbers, list hits that can include criminal-offence data, article 2.4), uploaded documents, company financial reports, quality and AEO records, incident reports, assistance requests |
| SimpliPeople | The Client's current and former employees and HR staff | Employee records (name, email, job, department, dates, hours), leave requests, leave and overtime with the decisions of line managers and HR on them, sick leave within article 2.4, published calendar links that show only that an employee is away and when, qualifications and documents, training results |
| SimpliAccept (optional module, if the Client uses it) | The Client's warehouse staff; shippers named in acceptance records | Acceptance records (shipment reference, destination, shipper name and city, pieces, weight, label and dangerous-goods details, damage, remarks, custom fields), the names of the staff who took in and accepted the goods, photos of the goods with notes; a share link the Client gives to a third party shows an accepted record (without the custom fields the Client marked internal) without sign-in |
| SimpliQuote (optional module, if the Client uses it) | Senders of quote enquiries and contact persons at the Client's business partners; the Client's users | Enquiry mails as the user pastes or opens them (sender name, e-mail address, subject, text), the fields read from them by an AI model, the business partner they belong to, the reply the Client drafts, price proposals and, where the Client switched it on, the quotation written to its own Connected System with the text of the enquiry as a document; panel sessions of the Outlook add-in (a hash of the key, user, host, dates) |
| SimpliFleet | Drivers and other employees a vehicle is linked to | Vehicle linked to a named driver or employee (which can be the employee's own car): licence plate, VIN, contract and insurance policy details, odometer readings, maintenance and damage records with their invoices, free-text notes |
Annex 2: Technical and organisational measures
- Hosting in the European Union, with a provider bound by a data processing agreement.
- Encryption of all traffic to the Portal; passwords stored as hashes; credentials for Connected Systems encrypted at rest.
- Separation of each organisation's data at database level; access per user on a need-to-know basis (least privilege); private storage for documents, handed out only after an access check.
- Administrative access limited to authorised persons over a secured connection.
- An audit log of significant actions.
- Regular backups within the European Union; security updates applied promptly.
- The test environment is protected by the measures of this Annex, runs with the same hosting provider in the European Union (Germany), and holds Client Personal Data only under article 3.6; it sends nothing to Connected Systems, and email outside SimpliSoft only to sign a user in, to that user's own address and marked as coming from the test environment.
- Confidentiality of everyone with access (article 4), and incident handling under article 9.
Annex 3: Client-specific arrangements
Only where the parties have agreed one under article 12. Each part applies only to the Client whose Offer names it, and describes the processing concerned, where it takes place, SimpliSoft's access, which measures of Annex 2 each party takes, any Sub-processors, and what happens at the end.