This data processing agreement is an agreement between the dance school that uses DanceAdmin (the customer, controller) and EXCITED software, owner Ed de Heus, Kamgrasstraat 30, 2288 HE Rijswijk, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 27144483 (we, processor). It forms part of the agreement on DanceAdmin and the terms and conditions, and applies for as long as we process personal data for the customer.
1. What we process the data for
We only process personal data to provide DanceAdmin to the customer: the dance school's administration, online registration and payment, the class schedule and events on the school's website, the student portal, the emails DanceAdmin sends on the school's behalf, and support. We never use the data for our own purposes.
2. Which data and whose
- Data subjects: students (for minors also parents or guardians), people who register or buy a ticket, dance partners named in a registration, teachers and the customer's users.
- Data: name, address, email address, phone number, date of birth, gender, student number, account number and direct debit mandate, enrolments, registrations, tickets, payments and discounts, attendance and make-up classes, labels and notes, and for users and teachers also role, permissions and teaching hours.
- DanceAdmin is not intended for special categories of personal data, such as health data. If the customer nevertheless puts such data in a note, the customer is responsible for that.
3. Only on the customer's instructions
We only process the data as the customer determines through DanceAdmin and its settings, or as the customer asks us in writing (including by email). If we believe an instruction conflicts with privacy legislation, we will say so immediately. If the law requires us to hand over data to a public authority, we inform the customer beforehand, unless that is not permitted.
4. Confidentiality
Everyone at our end who has access to the data is bound by confidentiality. We only access the data when necessary, for example for support at the customer's request, for migrating data or for fixing a problem.
5. Security
We take appropriate measures to protect the data, including:
- all connections are encrypted (https), and traffic passes through Cloudflare, which blocks attacks;
- each school's data is separated from that of other schools; within a school, the administrator decides per user what they can see and do;
- we only store passwords and sensitive keys (such as those for Mollie and email) in encrypted form;
- users are logged out automatically after half an hour of inactivity, and forms are protected against misuse;
- logins, failed attempts and important changes are recorded in a log;
- the server is in a data centre in the Netherlands and is managed by us only; we make regular backups and keep the software up to date.
The customer takes care of good passwords, only gives access to the right people and keeps their permissions as limited as necessary.
6. Sub-processors
The customer consents to the use of these sub-processors:
| Sub-processor | Purpose | Where |
|---|---|---|
| Cloudflare, Inc. | All traffic to DanceAdmin passes through Cloudflare, for speed and protection against attacks | Worldwide network; EU-US Data Privacy Framework and standard contractual clauses |
| Microsoft (Microsoft 365) | Sending DanceAdmin's emails, such as confirmations, login codes and payment requests | European Union; EU-US Data Privacy Framework and standard contractual clauses |
The database and the application run on our own server in the Netherlands. If the customer uses its own Microsoft 365 for email, or its own Mollie account for students' payments, the customer has its own agreement with that party; they are then not our sub-processors.
If we want to add or replace a sub-processor, we announce this by email at least one month in advance. If the customer has a well-founded objection, we look for a solution together; if that fails, the customer may cancel before the change takes effect. We impose the same obligations on our sub-processors as in this agreement.
7. Rights of data subjects
If a student or other data subject wants to view, correct, delete or take their data with them, the customer handles this. With DanceAdmin the customer can look up, change, delete and export data itself. If something does not work, we help. If we receive such a request directly, we forward it to the customer as soon as possible.
8. Data breaches
If we discover a security incident in which the customer's data has (possibly) been leaked, lost or compromised, we report this to the customer without undue delay and no later than 48 hours after discovery. We share what we know: what happened, which data and data subjects are affected, what the consequences may be and what we are doing about it. The customer decides whether to report the breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and the data subjects; we help with that.
9. Assistance and audits
We provide the customer with the information it needs to demonstrate that the processing complies with the law, and reasonably assist with a data protection impact assessment (DPIA) or questions from the supervisory authority. If the customer wants an audit, this is possible at most once a year, with at least 30 days' notice, by an independent expert bound by confidentiality and at the customer's expense.
10. After the agreement ends
After the agreement ends, we keep the data for another 6 months, so that the customer can have it exported or can come back. After that we delete it permanently, including from the backups as soon as they are replaced in the normal cycle. At the customer's request we delete it sooner, or first provide an export.
11. Liability and term
Article 11 of the terms and conditions applies to liability. This data processing agreement runs for as long as the agreement on DanceAdmin runs, and after that for as long as we still hold the customer's data. In the event of a conflict, this data processing agreement takes precedence over the terms and conditions, insofar as personal data is concerned.