LegioLog data processing agreement
Version 1.0, 30 October 2026. This data processing agreement forms part of the agreement between Basepay B.V., trading as LegioLog, Dutch Chamber of Commerce number 42081353 ("Processor") and the customer ("Controller") and applies for as long as LegioLog processes personal data on behalf of the customer. This English version is binding. Translations are provided for information only.
1. Subject and term
1.1 Processor processes personal data only to provide the Service as described in the agreement and the written instructions of Controller, and not for its own purposes.
1.2 This data processing agreement lasts as long as the agreement and for as long as Processor holds data afterwards.
2. Nature, purpose and categories
2.1 Nature and purpose of the processing: recording, storing, displaying and reporting entries in the digital legionella logbook, sending alerts, and providing support.
2.2 Categories of data subjects: employees and other users given access to the Service by Controller, and third parties authorised by Controller (such as a legionella adviser).
2.3 Categories of personal data: name, email address, account details, and entry data that can be traced to a user (who recorded which flush or task at what time). No special categories of personal data are processed; Controller ensures that these are not entered in free text fields either.
3. Obligations of Processor
3.1 Processor processes the data only within the European Economic Area, except for the supporting services listed in the privacy statement for which appropriate safeguards apply (an adequacy decision or standard contractual clauses).
3.2 Processor ensures that persons with access to the data are bound by confidentiality.
3.3 Processor takes appropriate technical and organisational measures, including: encrypted connections (TLS), encrypted password storage, access separation per organisation at database level (row level security), separation of duties for internal systems, backups, and an entry log that cannot be changed.
3.4 Processor assists Controller, as far as reasonably possible, in responding to requests from data subjects and in meeting its obligations on security, personal data breach notifications and data protection impact assessments. Processor may charge reasonable costs where the support requested goes beyond the standard functionality of the Service.
4. Sub-processors
4.1 Controller gives general authorisation for engaging sub-processors. The current list is in the privacy statement on legiolog.com.
4.2 Processor imposes obligations on sub-processors equivalent to this data processing agreement and remains responsible to Controller for their performance.
4.3 Processor announces an intended change of sub-processors at least 30 days in advance. Within that period Controller may object in writing, giving reasons; the parties then look for a reasonable solution. If that does not lead to a solution, Controller may terminate the agreement as of the date the change takes effect.
5. Personal data breaches
5.1 Processor informs Controller without undue delay, and no later than 48 hours after discovery, of a personal data breach, with the information Controller needs for any notification to the supervisory authority and to data subjects.
5.2 Notifying the supervisory authority and data subjects is the responsibility of Controller.
6. Audits
6.1 On request, Processor makes available the information Controller needs to assess compliance with this data processing agreement, including descriptions of the measures taken and available reports from the infrastructure providers.
6.2 At most once a year, or after a substantial breach, Controller may have an audit carried out at its own expense by an independent expert, with at least 30 days' notice and without unnecessary disruption of the service or of the confidentiality of other customers' data.
7. Return and deletion
7.1 After the agreement ends, Controller can export the data through the Service for 60 days (PDF and a machine-readable format). After that, Processor deletes the personal data, unless a legal obligation requires longer retention.
7.2 The parties acknowledge that the logbook serves as evidence and that entries are therefore not changed or deleted during the term; corrections are recorded as a new entry. Requests from data subjects for erasure are assessed by Controller, taking into account its legal retention obligations.
8. Liability and final provisions
8.1 The liability provisions of the terms and conditions apply to this data processing agreement.
8.2 In case of conflict between this data processing agreement and the agreement, this data processing agreement prevails as regards the processing of personal data.
8.3 This data processing agreement is governed by the laws of the Netherlands. The English version is binding.