Data processing agreement

DATA PROCESSING AGREEMENT

pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR)

JAAN BV – all services (web hosting, VPS and dedicated servers, Smsbox, 2mail, custom development)

Version: 2.6 – 27 October 2026

Processor: JAAN BV (Jaan Internet Solutions), registered office Zelzatestraat 61, 9960 Assenede, Belgium – KBO 0894.248.245 – privacy@jaan.be – 09 328 03 83

Controller: the Customer, as identified in the Main Agreement, the order or the customer account.

Article 1 – Scope and order of precedence

1.1 This Data Processing Agreement forms an integral part of every agreement between JAAN BV and the Customer for the provision of Services (the "Main Agreement"), including the general terms and conditions, orders and service descriptions of JAAN BV.

1.2 It applies to all processing of Customer Personal Data by JAAN BV as processor in the context of the Services, regardless of which Service the Customer purchases. Annex A describes the processing per Service.

1.3 In the event of any conflict between this Data Processing Agreement and the Main Agreement, this Data Processing Agreement prevails as regards the processing of Personal Data. Where the parties have signed the standard contractual clauses of Commission Implementing Decision (EU) 2021/915, those clauses prevail and the Annexes to this document serve to complete Annexes II to IV thereof.

Article 2 – Definitions

2.1 "Services": the services that JAAN BV provides to the Customer, including web hosting, virtual private servers (VPS) and dedicated servers, the Smsbox messaging services (SMS, WhatsApp Business and voice messages via text-to-speech), the 2mail e-mail services (e-mail marketing and SMTP relay) and custom development.

2.2 "Customer Personal Data": all personal data that JAAN BV processes on behalf of the Customer in order to provide the Services.

2.3 "Sub-processor": any third party engaged by JAAN BV to process Customer Personal Data for the provision of the Services.

2.4 "Transmission Service": any service of a telecom operator, SMS aggregator, third-party messaging platform or receiving e-mail server that serves exclusively to pass on messages to or from the recipient. Providers of Transmission Services are not Sub-processors of JAAN BV, nor of the Customer (see article 7.6 and Annex D).

2.5 "Data Breach": a personal data breach within the meaning of Article 4(12) GDPR.

2.6 Terms such as "controller", "processor", "data subject", "processing" and "supervisory authority" have the meaning given to them by the GDPR.

Article 3 – Roles of the parties

3.1 The Customer is the controller of the Customer Personal Data; JAAN BV is the processor. Where the Customer itself acts as processor for a third party, JAAN BV is a sub-processor and the Customer warrants that its own data processing agreement permits the engagement of JAAN BV.

3.2 JAAN BV is an independent controller of the data it processes for the management of the customer relationship: account data, contact persons, invoicing, support, security and fraud prevention of its own infrastructure, and compliance with legal obligations. That processing is governed by the privacy statement of JAAN BV.

3.3 The Customer warrants that it has a legal basis for the processing, that it informs the data subjects correctly, and that it does not have JAAN BV process any data in breach of the law, the fair use policy or the specific terms and conditions of JAAN BV. For commercial messages via Smsbox or 2mail, the Customer holds the required consent of the recipients and provides proof thereof at the request of JAAN BV.

Article 4 – Instructions

4.1 JAAN BV processes the Customer Personal Data exclusively on documented instructions from the Customer and for the provision of the Services. The Main Agreement, this Data Processing Agreement, the Customer's configuration of the Services (control panel, API, settings) and written support requests constitute instructions.

4.2 If JAAN BV considers that an instruction infringes the GDPR or other applicable legislation, it shall immediately inform the Customer thereof and may suspend its execution until the instruction has been amended.

4.3 Where JAAN BV is required by law to carry out processing, it shall inform the Customer of that legal requirement in advance, unless the law prohibits this on important grounds of public interest.

Article 5 – Confidentiality

5.1 The confidentiality obligation of article 14 of the general terms and conditions of JAAN BV applies. JAAN BV ensures that only authorised staff members have access to the Customer Personal Data, insofar as necessary for the provision of the Services, and that they are bound by a contractual or statutory obligation of confidentiality.

Article 6 – Security

6.1 JAAN BV takes appropriate technical and organisational measures within the meaning of Article 32 GDPR, as described in Annex B. JAAN BV may adapt those measures, provided that the level of security is not reduced.

6.2 The Customer remains responsible for security on its side: the management of its passwords, API keys and users, the security of the software and data it places on a hosting account, VPS or dedicated server (in the case of managed administration: the applications and data above the operating system), and the choice whether or not to send sensitive data via the Services.

Article 7 – Sub-processors

7.1 The Customer grants JAAN BV general written authorisation to engage Sub-processors. The Sub-processors used at the time this Data Processing Agreement is entered into are listed per Service in Annex C.

7.2 JAAN BV shall inform the Customer at least thirty (30) days in advance, by e-mail to the contact address registered with JAAN BV, of the addition or replacement of a Sub-processor. The current list is always set out in Annex C to this Data Processing Agreement.

7.3 The Customer may object on reasonable, substantiated grounds within ten (10) working days of that notification. The parties shall then seek a solution in good faith. If this is not successful, the Customer may terminate the part of the Services concerned without a termination fee.

7.4 JAAN BV imposes on each Sub-processor, in writing, obligations at least equivalent to those of this Data Processing Agreement and remains fully liable towards the Customer for the performance by its Sub-processors.

7.5 Software suppliers whose licences JAAN BV resells or uses (such as Microsoft SPLA) do not process Customer Personal Data and are not Sub-processors.

7.6 Providers of Transmission Services are not Sub-processors. They exclusively pass on the content of a message to the network or mailbox of the recipient, without processing its substance, and are bound by the secrecy of telecommunications or act as independent controllers for their own network. JAAN BV freely selects and changes these providers depending on the destination, availability and quality of delivery; the routes used are trade secrets of JAAN BV and are not disclosed. Annex D explains this further.

Article 8 – Transfers outside the EEA

8.1 JAAN BV processes the Customer Personal Data in Belgium. It does not transfer Customer Personal Data to countries outside the European Economic Area, except where Annex C states this for a specific Service and subject to the appropriate safeguards indicated there (adequacy decision, EU-U.S. Data Privacy Framework or standard contractual clauses).

8.2 The Customer acknowledges that the recipient of a message may be located outside the EEA and that the delivery of that message in that case entails a transfer for which the Customer, as controller, determines the legal basis.

Article 9 – Assistance with data subject rights

9.1 Taking into account the nature of the processing, JAAN BV assists the Customer in responding to requests from data subjects (access, rectification, erasure, restriction, portability, objection). The Customer can handle most requests itself via the control panel or the API of the Service; for the rest, JAAN BV provides assistance within ten (10) working days of the request.

9.2 If JAAN BV receives a request directly from a data subject concerning Customer Personal Data, it shall forward it to the Customer without undue delay and shall not respond to it itself, unless the Customer so requests.

Article 10 – Data Breaches

10.1 JAAN BV shall notify a Data Breach affecting Customer Personal Data without undue delay and at the latest within twenty-four (24) hours of becoming aware of it, by e-mail to the Customer's contact address registered with JAAN BV.

10.2 The notification contains, insofar as known: the nature of the Data Breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed and a contact point. Information that is not yet available will be provided in phases.

10.3 JAAN BV does not itself notify a Data Breach to the supervisory authority or the data subjects on behalf of the Customer, unless the Customer requests this in writing or the law obliges JAAN BV to do so.

Article 11 – Data protection impact assessment

11.1 On request, JAAN BV provides the Customer with reasonable assistance with a data protection impact assessment (DPIA) and any prior consultation of the supervisory authority, insofar as these relate to the Services and on the basis of the information available to JAAN BV.

Article 12 – Information and audit

12.1 On request, JAAN BV makes available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 GDPR and with this Data Processing Agreement, including the description of the measures in Annex B and, where available, certificates or audit reports from third parties.

12.2 If that information is reasonably insufficient, the Customer, or an independent auditor appointed by it who is bound by confidentiality, may carry out an audit no more than once a year, subject to prior written notice of at least thirty (30) days, during office hours and without disrupting the services provided to other customers or gaining access to their data. In the event of a suspected Data Breach or on the order of the supervisory authority, a shorter period applies.

12.3 Each party bears its own costs. If the audit requires more than one working day of JAAN BV's time, JAAN BV may charge the additional time at its usual hourly rate, unless the audit reveals a breach by JAAN BV.

Article 13 – Return and erasure

13.1 During the term, the Customer can always export its data itself via the Service (back-ups, database dumps, exports of contact lists and message logs) or request an export at the applicable rate.

13.2 After the end of the Main Agreement, or of the Service concerned, JAAN BV erases all Customer Personal Data, including back-ups in accordance with their normal rotation, within ninety (90) days, unless the Customer requests their return in writing before that date or a statutory retention obligation applies. On request, JAAN BV confirms the erasure in writing.

Article 14 – Liability

14.1 The liability provisions of the Main Agreement apply to this Data Processing Agreement, without prejudice to Article 82 GDPR and the mandatory provisions of the GDPR from which no contractual derogation is possible.

Article 15 – Term

15.1 This Data Processing Agreement applies for as long as JAAN BV processes Customer Personal Data and ends automatically after the erasure or return referred to in article 13.

Article 16 – Governing law and competent court

16.1 This Data Processing Agreement is governed by Belgian law. The courts of the judicial district of East Flanders, Ghent division, have exclusive jurisdiction, without prejudice to the right of the Customer and of data subjects to lodge a complaint with the Belgian Data Protection Authority (GBA/APD).

Annex A – Description of the processing per Service

Common to all Services: the duration of the processing is the term of the Main Agreement plus the erasure period of article 13; the processing comprises storage, transmission, back-up and technical management; no special categories of personal data are expected, unless the Customer itself processes them via the Service and takes responsibility for this itself.

Annex B – Technical and organisational measures

B.1 General (all Services)

• Locations: all systems are located in Belgium, at LCL Datacenter in Diegem and in the JAAN BV data centre in Zelzate. The JAAN BV data centre in Zelzate is secured with access control restricted to authorised personnel, camera surveillance and an alarm system. LCL Datacenter in Diegem is a professional colocation centre with 24/7 surveillance, access control, fire protection and redundant power and cooling.
• Network: firewalls at infrastructure and hypervisor level; network isolation between customer environments (Proxmox VE); management traffic separated from customer traffic; traffic to and from the Services encrypted with TLS.
• Access management: personal accounts with least privilege; administrative access exclusively via VPN and SSH keys; periodic review of access rights; immediate revocation upon departure; continuous anti-fraud and abuse monitoring on the Smsbox gateway with blocking of suspicious access.
• Continuity: databases in master-master replication across two locations; daily back-ups with a retention period of fourteen (14) days on a separate back-up server.
• Patch management: security updates for operating systems and platform software are applied weekly; critical vulnerabilities immediately once a patch is available.
• Logging and monitoring: system, access and application logs are limited per application to what is necessary for security, troubleshooting and legal obligations (see Annex E); monitoring of availability and anomalous behaviour.
• Malware and spam: virus and spam filtering on the mail infrastructure; automated intrusion prevention with firewall, fail2ban and fraud detection; JAAN BV uses all reasonable means to ensure maximum security of its infrastructure and, for security reasons, does not disclose the specific detection tools.
• Personnel: confidentiality obligation in employment and service agreements; need-to-know principle.
• Incident management: documented procedure for identifying, containing and reporting security incidents (see article 10); significant incidents are reported to the Centre for Cybersecurity Belgium in accordance with the NIS2 Act of 26 April 2024; reporting mechanism for illegal content in accordance with the Digital Services Act.
• Erasure: secure erasure of data carriers upon decommissioning; erasure of customer data in accordance with article 13.

B.2 Web hosting

• Separation of customer accounts at operating system and web server level (SiteWorx accounts with their own user).
• Mail traffic secured with TLS, SPF/DKIM/DMARC support; automated detection of malware and malicious scripts in customer accounts, with notification to the Customer upon detection.

B.3 VPS and dedicated servers

• VPS: full isolation of virtual machines on the hypervisor. Dedicated server: physical server exclusively for the Customer, in the data centre of JAAN BV.
• Unmanaged: the Customer manages the operating system and the data itself and is responsible for security within the VPS.
• Managed: JAAN BV manages the operating system in accordance with the measures of B.1 (weekly security updates, firewall, fail2ban, monitoring, administrative access via VPN and SSH keys). Administrative access is used only for maintenance, security and support at the request of the Customer; the Customer remains responsible for its applications and data.
• Back-ups of the entire server (daily or weekly, on a separate back-up server) and, for VPS, disk snapshots (1× or 2× per day, on the hypervisor) are separate options for managed and unmanaged servers; in each case the most recent four (4) are retained. Without these options, the Customer is itself responsible for its back-ups.

B.4 Smsbox

• Login with personal accounts; support for passkeys/WebAuthn; secure sessions; API access with keys per account.
• Content Security Policy with nonces; all connections via HTTPS.
• Voice messages: outgoing only, generated from text at the time of sending; no audio recordings of the recipient are made and no audio files are retained; only the text, the number and the call status are retained, for the same period as SMS.
• Opt-out via STOP is only possible where the Customer has activated the reply option; messages are then sent via shortcode 8676 (Belgium) rented by JAAN BV, and STOP replies are automatically placed on a block list per account. In all other cases, STOP requests are processed and managed by the recipient's mobile operator itself, insofar as that operator supports this; these lists are not accessible to JAAN BV. In addition, the Customer itself provides a means of unsubscribing in its messages. Data minimisation: only the number, content, status and timestamp are retained.
• Message content, delivery reports and associated logs are retained for thirteen (13) months and then automatically erased or anonymised (see Annex E); retention by Transmission Services is set as short as possible.

B.5 2mail

• Sending via JAAN BV's own Postfix infrastructure with TLS; per-domain rate limiting and IP warm-up; SPF, DKIM and DMARC.
• Automatic bounce and complaint processing; unsubscribes are immediately placed on a blocklist that is synchronised to the mail servers.
• Tracking data (opens, clicks) are retained in accordance with Annex E; contact lists are erased as soon as the Customer deletes them or in accordance with article 13.

Annex C – Sub-processors

This list contains the Sub-processors within the meaning of article 2.3. Providers of Transmission Services (articles 2.4 and 7.6) and software licensors (article 7.5) are not included. This list is confidential business information and may only be used by the Customer for compliance with the GDPR.

The data centres' connectivity suppliers (Destiny, Telenet) provide internet transport only and are not Sub-processors. Google Analytics is used only on the public websites of JAAN BV, for which JAAN BV itself is the controller, and not in the customer portals. Last updated: 24 October 2026.

Annex D – Explanatory note on Transmission Services

Why are telecom operators, SMS aggregators and receiving mail servers not included in the list of Sub-processors?

A message that the Customer sends via Smsbox or 2mail must be physically delivered to the mobile network or the mailbox of the recipient. To do so, the message passes over third-party networks: telecom operators and their aggregators for SMS, Meta's platform for WhatsApp, and the recipient's mail server (for example Microsoft, Google or a company's own mail server) for e-mail.

These parties do not process the substance of the message for the Customer. They merely pass it on, in the same way as the postal service delivers a letter. Telecom operators are moreover bound by the secrecy of telecommunications and may not inspect the content. Receiving mail servers are managed by the recipient or its own supplier, outside any instruction of the Customer or of JAAN BV. They therefore act as a mere conduit or as an independent controller for their own network, and not as a processor or sub-processor within the meaning of Article 28 GDPR. This approach is common practice in the communication services sector.

Meta (WhatsApp Business Platform) is an exception: Meta stores and processes messages on its platform on behalf of the business user and is therefore listed as a Sub-processor in Annex C.

The choice of transmission routes per destination is a trade secret of JAAN BV and does not form part of the information provided under this Data Processing Agreement. JAAN BV guarantees that every provider used is bound by the secrecy of telecommunications or by contractual confidentiality obligations, and that messages to recipients within the EEA are delivered via providers in the EEA.

Annex E – Retention periods

These periods apply to the Customer Personal Data during the term. After the end of the Service, article 13 applies (erasure within 90 days). The same periods are published at jaan.be/data-retentie.