Data Processing Agreement

Version 31 October 2026

This translation has the same content as the Dutch version.

This data processing agreement is part of the additional terms for installers. It applies between:

• the business that uses BoilerBuddy as an installer and has accepted those terms, the controller ("you" or "the installer"); and
• Peters Development, trading as BoilerBuddy, Bijsterhuizen 2414, 6604 LL Wijchen (the Netherlands), Chamber of Commerce (KvK) 77119185, the processor ("we").

Terms such as personal data, processing and personal data breach (data breach) have the meaning given to them by the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

1. Subject matter and duration

1. This agreement covers the personal data that the installer records in BoilerBuddy or has BoilerBuddy process: their customers (name, email address, phone number, address, notes and locations), the readings of their devices at those customers, the invitations to follow along and the requests that come in through the installer directory. Annex 1 describes them precisely.
2. It runs as long as the additional terms for installers run, and after that until we have returned or deleted the data under Article 12.
3. Not covered by this agreement is what we process ourselves as controller, such as users' accounts, the devices a customer owns themselves (also after a transfer), payments, forwarding a request from the directory and the security of the service. For that, the privacy policy applies.

2. Nature and purpose of the processing

1. Nature. We store the data, organize it and show it in the portal to those who have access to it under the permissions. We calculate with the readings (summaries, status, alerts, the savings estimate), send emails (alerts, invitations, requests), make backups and delete data when the installer does so or the retention period expires.
2. Purpose. Only to provide the BoilerBuddy service to the installer: keeping their customer records, managing the devices at their customers, sending alerts, letting customers follow along and showing requests.
3. We do not use the data for our own purposes or for marketing, do not sell it and do not build profiles with it.

3. Types of data and data subjects

1. Data subjects: the installer's customers (private individuals, and contact persons of business customers), the occupants or users of the places where their devices are installed, the people they invite to follow along, and the people who send them a request through the directory.
2. Data: contact details, addresses, notes, locations, readings and technical data of devices, invitations and requests, as set out in Annex 1.
3. The installer does not record special categories of personal data (Article 9 GDPR), data on criminal convictions, or citizen service numbers (BSN) or other national identification numbers.

4. Only on instructions

1. We process the data only on documented instructions from the installer. Instructions are the additional terms, this agreement and what the installer and their members do in the portal, such as recording, changing, sharing, inviting and deleting data. The installer gives other instructions by email to info@boilerbuddy.eu.
2. If the law requires us to process the data otherwise, we tell the installer beforehand, unless that law prohibits it.
3. If we believe an instruction infringes the GDPR or other data protection rules, we say so immediately.

5. Confidentiality

1. Anyone at our end with access to the data is bound by confidentiality, by agreement or by law.
2. Only a small number of administrators have access to the admin area, all with two-factor authentication. They only look at the data when that is needed to help the installer, fix a fault or stop misuse, or when the law requires it.

6. Security

1. We take appropriate technical and organizational measures (Article 32 GDPR). At present:
   • all connections to the website, the portal and the API are encrypted (https);
   • we store passwords, device API keys and the links in invitations only as a hash;
   • secrets, such as the two-factor authentication key, are encrypted in the database, and sessions are encrypted;
   • every user can turn on two-factor authentication; for administrators it is mandatory;
   • permissions per role: owner, admin and technician within the business, viewer or installer when sharing. Customer details and notes are only visible to the installer's members;
   • limits on logins and forms, against misuse;
   • the server is in Germany, at LumaDock, with a firewall and automatic security updates;
   • a backup every night, kept for 14 days, with an encrypted copy off the server at a storage service in the EU. That service cannot read the contents;
   • we store installers' photos without the data embedded in the file, such as where they were taken.
2. We may adapt measures to new technology or risks, but never so that security is reduced.
3. The installer takes care of their side: who is a member and with which role, good passwords, two-factor authentication, and removing a colleague who leaves from the members straight away.

7. Sub-processors

The installer authorizes us to engage these sub-processors:

1. We notify the owners of the business by email at least 30 days in advance of a new sub-processor, or a different one replacing an existing one. During that time the installer can object, giving reasons. If we cannot resolve it together, the installer can terminate the agreement free of charge before the change, and gets back what they paid in advance for the period after it.
2. We impose the same obligations as in this agreement on every sub-processor in writing. We remain responsible to the installer for what they do.

8. Transfers outside the EEA

The data stays in the European Economic Area. We do not currently transfer it outside. If that does happen later, it will only be with appropriate safeguards under Chapter V of the GDPR, and after we have given notice under Article 7 paragraph 1.

9. Data subjects' rights

1. The installer answers requests from data subjects themselves, such as for access, rectification, erasure or objection. Much of it can be done in the portal: changing a customer's details, deleting a customer, ending follow-along access.
2. If such a request reaches us, we forward it to the installer without undue delay. We do not answer it ourselves, unless the installer asks us to.
3. What the installer cannot do in the portal, such as an export of a device's readings, we do at their request, within a reasonable time.

10. Data breaches

1. If we discover a data breach involving the installer's data, we report it without undue delay, and no later than 48 hours after discovery, by email to the owners of the business.
2. We include what we know: what happened, which types of data and approximately how many data subjects and records are concerned, the likely consequences, what we have done and propose to limit the consequences, and who the contact person is. We add what we learn later.
3. The installer decides whether to report the breach to the supervisory authority or the data subjects. We do not report it on their behalf, unless they ask us to or the law requires it. We help them with the information they need for it.
4. We keep a record of all data breaches, with what we did about them.

11. Assistance with a DPIA

If the installer has to carry out a data protection impact assessment (DPIA), or consult the supervisory authority beforehand, we help with the information we have about BoilerBuddy. If that takes more than a reasonable effort, we agree the costs in advance.

12. Ending: return and deletion

1. When the agreement ends, we give the installer, at their request, an export of their data: their customers and the readings of their devices, in a common format such as CSV. They request it before the end or at the latest 30 days afterwards.
2. After that we delete the data, at the latest 30 days after the end, unless the law requires us to keep it. It is gone from the backups once their retention period of 14 days has passed.
3. On request, we confirm that the data has been deleted.
4. Devices the installer has transferred to a customer belong to that customer. Their data is no longer covered by this agreement.

13. Information and audits

1. On request, we give the installer the information needed to show that we comply with this agreement and Article 28 GDPR, such as a description of the security measures and the list of sub-processors.
2. If that is not enough, the installer may have an audit carried out by an independent expert bound by confidentiality. The audit is at the installer's expense, including the reasonable time it costs us, at most once a year (except after a data breach or at the request of a supervisory authority), and is announced at least 30 days in advance. It does not disrupt the service and gives no access to other parties' data.
3. If the audit finds shortcomings on our side, we fix them at our own expense.

14. Liability

Liability between the installer and us is governed by Article 10 of the additional terms for installers. The rights of data subjects under Article 82 GDPR continue to apply. A fine imposed on a party by a supervisory authority is borne by that party.

15. Other provisions

1. If this agreement and the additional terms conflict, this agreement prevails as far as the processing of personal data is concerned.
2. Changes are made as set out in Article 12 of the additional terms.
3. This agreement is governed by Dutch law. Disputes go to the District Court of Gelderland (Rechtbank Gelderland, the Netherlands).

Annex 1: data, data subjects, purpose and retention