Last updated: 2026-10-11 · v5.2
This Data Processing Agreement (“DPA”) sets out the terms under which suPlay BV (“Processor”) processes Personal Data on behalf of the Customer (“Controller”) in connection with the Supplier Satisfaction Analysis Platform (“SSA Platform”). It is designed to meet the requirements of Article 28 of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”).
How to sign: download the PDF version on request, fill in Annex A with your organisation’s details, sign, and email the signed copy to privacy@suplay.nl. We will counter-sign promptly. Enterprise-tier customers may also sign via DocuSign on request.
This DPA applies to all Processing of Personal Data carried out by suPlay BV on behalf of the Controller under the Main Agreement. It is in force for the duration of the Main Agreement and survives until all Personal Data processed hereunder has been deleted in accordance with §10.
The Processor processes Personal Data solely to provide the Services: to operate buying-firm accounts, distribute and collect supplier-satisfaction surveys, deliver analysis and reporting, handle transactional email, and manage billing. A full description of Processing activities, categories of Data Subjects, and categories of Personal Data is set out in Annex B. Reporting and questionnaire translation are AI-assisted; where and how a language model is involved, and exactly which data reaches it, is set out in Annex D.
The Processor processes Personal Data only on documented instructions from the Controller. Use of the Services through their documented user interfaces and APIs constitutes such instructions. The Processor will inform the Controller if, in its opinion, an instruction infringes the GDPR or other applicable data-protection law.
The Processor ensures that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
The Processor implements appropriate technical and organisational measures, including those described at /security. Measures include, at minimum:
The Controller gives the Processor general written authorisation to engage Subprocessors under Art. 28(2) GDPR, and authorises those listed on our Subprocessors page as of the Effective Date. The Processor will:
A Controller may subscribe to these notifications by emailing privacy@suplay.nl.
Taking into account the nature of the Processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller’s obligations to respond to Data Subject rights requests (Chapter III GDPR), data breach notification, data protection impact assessments, and prior consultation with the supervisory authority.
The Processor notifies the Controller without undue delay, and in any case within 72 hours of becoming aware, of any Personal Data breach affecting the Controller’s data. The notification will describe the nature of the breach, categories and approximate number of affected Data Subjects, likely consequences, and remediation measures taken or proposed.
On termination of the Main Agreement, the Controller may export its Personal Data for 30 days. After that period, the Processor deletes all Personal Data processed under this DPA within 90 days, including from database backups on their next rotation, unless Union or Member State law requires longer storage (for example, Dutch tax law requires billing records to be retained for seven years).
Inactive accounts. A buying-firm user account without use (signing in or using the API) for 24 months is deleted, with a warning email at 23 months; this deletes that user’s personal account only. For the only administrator of the Controller’s organisation, where that organisation has surveys, the period is 36 months, with warning emails at 35 months and 7 days before deletion. If, when that account is deleted, no other user of the Controller’s organisation remains, no consultancy that manages the organisation on the platform still has users, and none of its surveys received a response in the last 12 months, the Main Agreement is treated as terminated and the Processor deletes the Controller’s Personal Data together with that account; the warning emails, the first sent at least 30 days before the deletion, take the place of the 30-day export period above. Otherwise the organisation and its Personal Data stay while it is in use. An account is never deleted sooner than 30 days after its first warning email, nor sooner than 7 days after the final one. Platform super administrator accounts are not deleted automatically.
Organisations no longer in use. Once no user of the Controller’s organisation remains, no consultancy that manages the organisation on the platform has users, and in the last 12 months the organisation was not created, none of its surveys was created and none received a response, the Main Agreement is treated as terminated and the Processor deletes the Controller’s Personal Data within 30 days. With no user left to export it, the 30-day export period above does not apply. This includes an organisation kept when its last administrator’s account was deleted. An organisation that has a user is never closed this way.
The Processor makes available to the Controller all information necessary to demonstrate compliance with Art. 28 GDPR, including this DPA, the Subprocessors page, the Security Summary, and our internal processing inventory on request. The Processor supports remote, questionnaire-based audits at no cost, and on-site audits at the Controller’s reasonable expense. The Controller will provide at least 30 days’ notice and audits will not disrupt operations. Audits are limited to once per calendar year unless required by a supervisory authority.
Where Personal Data is transferred outside the European Economic Area to a Subprocessor, the transfer is made on the basis of the European Commission’s Standard Contractual Clauses (Decision 2021/914 or any successor), unless the recipient country has an adequacy decision under Art. 45 GDPR.
This applies equally to the survey aggregates sent to a cloud AI provider under Annex D. The Processor’s stated preference is an AI provider that processes entirely within the European Economic Area; where the provider currently configured is outside the EEA, that fact and its transfer basis are stated for that provider on the Subprocessors page rather than left implicit.
Each party’s liability under this DPA is subject to the liability limits of the Main Agreement. In case of conflict between this DPA, the Main Agreement, and the GDPR, the GDPR prevails, then this DPA, then the Main Agreement.
This DPA is governed by the laws of the Netherlands. Disputes are subject to the exclusive jurisdiction of the District Court of Overijssel (Rechtbank Overijssel, locatie Almelo), without prejudice to a Data Subject’s statutory rights of complaint to a supervisory authority.
Processor: suPlay BV, Ruwerstraat 9, 7545 SM Enschede, The Netherlands. KvK: 70176264. VAT: NL858175691B01. Represented for signature by Holger Schiele, Managing Director. Data Protection contact: Frederik Vos (Co-founder), privacy@suplay.nl.
Controller:
Subject matter and duration: operation of the SSA Platform, for the duration of the Main Agreement.
Nature and purpose: delivering a supplier-satisfaction survey platform enabling buying organisations to invite their suppliers to complete structured questionnaires, analyse results, and generate reports — with associated transactional email, billing, and error monitoring.
Categories of Data Subjects:
Categories of Personal Data:
Special categories of data: none are knowingly processed. The Controller is responsible for ensuring no special-category data (Art. 9 GDPR) is submitted through survey responses or free-text fields unless a separate lawful basis applies.
Processing operations: collection, storage, analysis (statistical aggregation, AI-assisted report generation — see Annex D), display to authorised parties, transmission to Subprocessors for email / error-monitoring / payments / AI report generation, erasure on request or schedule.
The current list of Subprocessors is maintained on our Subprocessors page and incorporated into this DPA by reference.
D.1 Where the processing happens. AI-assisted report generation and questionnaire translation run by default on a language model that the Processor hosts on its own hardware in the Netherlands; in that case no third party is involved. If the self-hosted model is unreachable, report generation would automatically fall back to the first configured cloud AI provider listed on the Subprocessors page, in the order shown there. The failover is automatic and is not surfaced in the interface, which is why every provider the Platform can reach is listed in advance under §7. Questionnaire translation has no fallback: if the self-hosted model is unreachable it fails with an error rather than being routed to a third party.
The cloud fallback is off by default: it is reached only while the Processor’s platform administrator has switched it on, and it is currently switched off. While it is off, the failover described above cannot occur and both features behave the same way: they use the self-hosted model or they fail. The mechanism is documented, and the providers the Platform would be able to reach are listed, so that switching one on is a disclosed change rather than a silent one.
D.2 What reaches a model. The prompt is identical on the self-hosted path and the fallback path, and contains only aggregates: the buying firm’s name; the number of completed responses; per dimension the mean score, the number of respondents and the standard deviation; the questionnaire item texts truncated to 50 characters, each with its mean score; and — for a Preferred Customer Assessment only — the names of the rated supplier organisations grouped by the matrix quadrant they fall into, with no score attached to an individual supplier name.
D.3 What never reaches a model. No individual response: scores are aggregated across respondents before a prompt is built, so no answer is attributable to an identified individual, whatever the survey’s anonymity setting. No free-text or open-ended answer, in any form. No respondent name, contact name, email address, invitation token, access code, IP address or credential.
D.4 Requirements on a cloud AI provider. The Processor will not configure a cloud AI provider unless, under the terms applicable to the Processor’s account, that provider (a) acts only as a processor on the Processor’s instructions; (b) does not use the submitted content to train or improve its models; (c) retains the submitted content only as long as needed to return a response, plus a defined and limited abuse-review period; and (d) is engaged under a data-processing agreement meeting Art. 28(3) GDPR. Preference is given to providers that process entirely within the European Economic Area. Where the configured provider is outside the EEA, §12 applies and the transfer basis is stated for that provider on the Subprocessors page.
D.5 No automated decision-making. Model output is a narrative draft. It is presented to the Controller’s own users for review and editing before it is used, and it produces no decision with legal or similarly significant effect on a Data Subject within the meaning of Art. 22 GDPR.