Search

- 
- [Academy](/en/elvy-academy/)
- [Support](/en/about-us/support/)
- [Contact](/en/about-us/contact/)
- [About Elvy](/en/about-us/)
- [NL](/nl/algemene-voorwaarden/) [EN](/en/terms-and-conditions/)

[Elvy](/en/)

Search

Request demo

Menu

X

## Request a no-obligation demonstration of our software

Would you like to find out what Elvy can do for your organisation? Request a no-obligation demonstration now!

- [Home](/en/)
- Terms and Conditions

# **Terms and Conditions** .

Nederpelt Software B.V., also trading under the name ‘Elvy’, hereinafter referred to as: Elvy, with its registered office in Westland, having its place of business at Stoelmatter 1a, Wateringen (2292 JM) and registered with the Haaglanden Chamber of Commerce under number 27235089.

### Chapter 1. General provisions

**Article 1 Applicability of the General Terms and Conditions**

1.1 These general terms and conditions apply to all offers and Agreements and/or other legal relationships whereby Elvy supplies goods and/or services of any nature and under any name whatsoever to the Customer.

1.2 Deviations from and additions to these general terms and conditions shall only apply if they have been set out in writing by Elvy.

1.3 The applicability of the Customer’s purchasing or other terms and conditions is expressly rejected.

1.4 If and insofar as Elvy makes third-party products or services available to the Customer or grants access thereto, the (licence or sales) terms and conditions of the relevant third parties shall apply in the relationship between Elvy and the Customer, to the exclusion of any provisions in these general terms and conditions that deviate from them, provided that the applicability of the (licence or sale) terms and conditions of those third parties has been communicated by Elvy to the Customer and a reasonable opportunity has been provided to take note of those terms and conditions. Notwithstanding the preceding sentence, the Customer shall not be entitled to rely on any failure by Elvy to comply with the aforementioned obligation if the Customer is a party as referred to in Article 6:235(1) or (3) of the Dutch Civil Code.

1.5 If and insofar as the aforementioned third-party terms and conditions prove not to apply, or are declared inapplicable, in the relationship between the Customer and Elvy for any reason whatsoever, these general terms and conditions shall remain in full force and effect.

1.6 If any provision of these general terms and conditions is void or is set aside, the remaining provisions of these general terms and conditions shall remain in full force and effect. In that event, Elvy and the Customer shall enter into consultation with the aim of agreeing on new provisions with, as far as possible, the same effect to replace the void or annulled provisions.

**Article 2 Definitions**

2.1 In these general terms and conditions, the following words and terms, amongst others, are capitalised. All of the following words and terms in the singular have the same meaning as in the plural, and vice versa.

Licence: the right to use, and the right to maintenance of, the software as provided by Elvy under a written Agreement with the Customer.

Maintenance: the maintenance of the software.

Support: assistance with the use of the software.

Online service: the Software-as-a-Service (SaaS) service for making the software available to the Customer online via the internet or another data network and keeping it available, together with Support in this regard, without the relevant underlying software being made available to the Customer as a download or as source code.

Agreement: All Agreements between Elvy and the Customer concerning the Elvy Products and/or Services.

Software: The Software, not specifically developed for the Customer, together with the accompanying documentation, which has been made available for use by Elvy pursuant to the Agreement and which is or will be maintained. The term ‘Software’ also includes Software that has been improved or modified by Elvy, as well as new versions of the Software.

Working Days: Monday to Friday, with the exception of public holidays generally recognised or designated in the Netherlands;

Working hours: office hours during working days, namely 09:00 to 17:00.

**Article 3 Offer**

3.1 All offers and other communications from Elvy are non-binding, unless otherwise stated in writing. The Customer guarantees the accuracy and completeness of the information provided to Elvy by or on behalf of the Customer, on which Elvy has based its offer, with the exception of obvious typographical errors.

**Article 4 Price and Payment**

4.1 All prices are exclusive of value added tax (VAT) and other product- or service-specific levies imposed by the government. All prices quoted by Elvy are in euros and the Customer must pay in euros.

4.2 The Customer may not derive any rights or expectations from a preliminary calculation or estimate issued by Elvy, unless the parties have agreed otherwise in writing.

4.3 If, under the Agreement, the Customer consists of several natural persons and/or legal entities, each of those persons or entities shall be jointly and severally liable to Elvy for the performance of the Agreement.

4.4 Where the Customer has a recurring payment obligation, Elvy is entitled once a year to adjust the applicable prices and rates in line with price changes for third-party products and/or services and to index them in accordance with the CPI index published by Statistics Netherlands (CBS) for the preceding 12 (twelve) months. Elvy shall notify the Customer of the adjustment to prices and rates for the following year no later than one month before the end of the current year.

4.6 The Parties shall specify in the Agreement the date on which Elvy shall invoice the Customer for the agreed services. Amounts due shall be paid by the Customer in accordance with the agreed terms of payment or those stated on the invoice. A payment term of 14 days applies. The Customer is not entitled to suspend any payment nor to set off amounts due.

4.7 If the Customer fails to pay the amounts due, or fails to do so on time, the Customer shall, without the need for a reminder or notice of default, be liable to pay statutory interest on the outstanding amount as applicable to commercial contracts. If, following a reminder or notice of default, the Customer continues to fail to settle the claim, Elvy may refer the claim to a debt collection agency and the Customer shall be liable, in addition to the total amount then due, to reimburse all reasonable judicial and extrajudicial costs, including all costs charged by external experts. This is without prejudice to Elvy’s other statutory and contractual rights.

**Article 5 Confidentiality**

5.1 The Customer and Elvy shall ensure that all information received from the other party which they know, or ought reasonably to know, to be of a confidential nature remains confidential. This prohibition shall not apply if and to the extent that the disclosure of the relevant information to a third party is necessary pursuant to a court order, a statutory provision, on the basis of a lawful order from a public authority, or for the proper performance of the Agreement. The party receiving confidential information shall use it solely for the purpose for which it was provided. Information shall in any event be regarded as confidential if it has been designated as such by one of the parties.

5.2 The Customer acknowledges that the Software made available by or via Elvy is always of a confidential nature and that it contains trade secrets of Elvy, its supplier or the software manufacturer.

**Article 6 Privacy and data processing**

6.1 If and insofar as applicable in the context of the performance of the Agreement, personal data will be processed in accordance with the General Data Protection Regulation (GDPR), as further set out in Chapter 2 of these general terms and conditions.

6.2 If, in Elvy’s opinion, this is relevant to the performance of the Agreement, the Customer shall, upon request, inform Elvy in writing of the manner in which the Customer fulfils its obligations under data protection legislation.

6.3 The Customer shall indemnify Elvy against any claims from individuals whose personal data is or will be processed for which the Customer is responsible under the law, unless the Customer proves that the facts underlying the claim are attributable to Elvy.

6.4 Responsibility for the data processed by the Customer using an Elvy service lies with the Customer. The Customer warrants to Elvy that the content, use and/or processing of the data is not unlawful and does not infringe any third-party rights. The Customer shall indemnify Elvy against any legal claim by a third party, on whatever grounds, in connection with this data or the performance of the Agreement.

6.5 If Elvy carries out work relating to the Customer’s data, its employees or users pursuant to a request or a valid order from a public authority or in connection with a legal obligation, all associated costs may be charged to the Customer.

**Article 7 Security**

7.1 Information security shall meet a standard which, having regard to the state of the art, the implementation costs, the nature, scope and context of the information to be secured as known to Elvy, the purposes and normal use of its products and services, and the likelihood and severity of foreseeable risks, is not unreasonable.

7.2 Any access or identification codes, certificates or other security measures provided to the Customer by or on behalf of Elvy are confidential and shall be treated as such by the Customer and disclosed only to authorised staff members within the Customer’s own organisation. Elvy is entitled to amend any assigned access or identification codes and certificates. The Customer is responsible for managing authorisations and for issuing and revoking access and identification codes in a timely manner.

7.3 If the security measures or the testing thereof relate to software, equipment or infrastructure not supplied to the Customer by Elvy itself, the Customer warrants that all necessary licences or approvals have been obtained to enable the provision of the services in question. Elvy shall not be liable for any loss arising in connection with the provision of these services. The Customer shall indemnify Elvy against any legal claim on any grounds whatsoever arising in connection with the provision of these services.

7.4 Elvy is entitled to amend the security measures from time to time if this is necessary as a result of changing circumstances.

7.5 The Customer shall adequately secure its systems and infrastructure and ensure they remain adequately secured.

7.6 Elvy may issue instructions to the Customer regarding security, the purpose of which is to prevent or minimise incidents or the consequences of incidents that could compromise security. If the Customer fails to follow such instructions from Elvy or a relevant government body, or fails to do so in a timely manner, Elvy shall not be liable and the Customer shall indemnify Elvy against any loss or damage that may arise as a result.

7.7 Elvy is at all times entitled to implement technical and organisational measures to protect equipment, data files, websites, (provided) Software or other works to which the Customer is granted access (directly or indirectly), including in connection with an agreed restriction on the content or duration of the right to use these items. The Customer shall not remove or circumvent such technical measures, nor allow them to be removed or circumvented.

**Article 8 Retention of title and rights, and suspension**

8.1 All goods delivered to the Customer shall remain the property of Elvy until all amounts owed by the Customer to Elvy under the Agreement concluded between the parties have been paid in full to Elvy. A Customer acting as a reseller may sell and resupply all goods subject to Elvy’s retention of title to the extent that this is customary in the normal course of its business.

8.2 The consequences under property law of the retention of title to goods intended for export shall be governed by the law of the country of destination, provided that such law contains provisions more favourable to Elvy in this respect.

8.3 Where applicable, rights shall be granted or transferred to the Customer on condition that the Customer has paid all sums due under the Agreement.

8.4 Elvy may retain the data, documents, Software and/or data files received or produced in the context of the Agreement, notwithstanding any existing obligation to hand them over or transfer them, until the Customer has paid all sums due to Elvy.

**Article 9 Transfer of Risk**

9.1 The risk of loss, theft, misappropriation or damage to goods, data (including: usernames, codes and passwords), documents, Software or data files produced for, supplied to or used by the Customer in the context of the performance of the Agreement shall pass to the Customer at the moment they are brought under the actual control of the Customer or a person acting on the Customer’s behalf.

**Article 10 Intellectual Property**

10.1 All intellectual property rights in the Software, websites, data files, databases, equipment, training, test and examination materials or other materials such as analyses, designs, documentation, reports, quotations, as well as preparatory material relating thereto, shall vest exclusively in Elvy, its licensors or its suppliers. The Customer shall only acquire the rights of use expressly granted under these general terms and conditions, the Agreement concluded in writing between the parties and by mandatory provisions of law. Any right of use granted to the Customer is non-exclusive, non-transferable, non-pledgeable and non-sublicensable.

10.2 If Elvy is prepared to undertake to transfer an intellectual property right, such an undertaking may only be given in writing and expressly. If the parties agree in writing that an intellectual property right relating to software, websites, data files, equipment, know-how or other works or materials developed specifically for the Customer is to be transferred to the Customer, this shall not affect Elvy’s right or ability to use and/or exploit, without any restriction, the components, designs, algorithms, documentation, works, protocols, standards and the like underlying that development for other purposes, whether for itself or for third parties. Elvy also has the right to use and/or exploit, without any restriction, the general principles, ideas and programming languages used in the creation of, or underlying the development of, any work for other purposes, either for itself or for third parties. Nor does the transfer of an intellectual property right affect Elvy’s right to carry out, for its own benefit or that of a third party, developments that are similar to or derived from those carried out for the Customer’s benefit.

10.3 The Customer shall not remove or alter (or cause to be removed or altered) any indication(s) relating to confidentiality or to copyright, trade marks, trade names or any other intellectual property right from the software, websites, data files, equipment or materials.

10.4 Elvy shall indemnify the Customer against any claim by a third party based on the ground that software, websites, data files, equipment or other materials developed by Elvy itself infringe an intellectual property right of that third party, provided that the Customer informs Elvy immediately in writing of the existence and content of the claim and leaves the handling of the matter, including the reaching of any settlements, entirely to Elvy. To this end, the Customer shall grant Elvy the necessary powers of attorney, information and cooperation to defend itself against such claims. This obligation to indemnify shall lapse if the alleged infringement relates (i) to works or materials made available to Elvy by the Customer for use, editing, processing or maintenance, or (ii) to modifications which the Customer has made, or caused to be made, to the software, websites, data files, equipment or other works or materials. If it is irrevocably established in a court of law that the software, websites, databases, equipment or other materials developed by Elvy itself infringe any intellectual property right belonging to a third party, or if, in Elvy’s opinion, there is a reasonable likelihood that such an infringement will occur, Elvy shall, where possible, ensure that the Customer can continue to use the delivered items, or other software, websites, data files, equipment or materials that are functionally equivalent. Any other or more far-reaching obligation on the part of Elvy to indemnify the Customer in respect of an infringement of a third party’s intellectual property right is excluded.

10.5 The Customer warrants that no third-party rights prevent the provision to Elvy of equipment, software, material intended for websites, databases and/or other materials, designs and/or other works to Elvy for the purposes of use, maintenance, modification, installation or integration, including the possession of the appropriate licences. The Customer shall indemnify Elvy against any claim by a third party based on the ground that such provision, use, maintenance, modification, installation or integration infringes any right of that third party.

10.6 Elvy is under no obligation to carry out data conversion, unless this has been expressly agreed in writing with the Customer.

10.7 Elvy is entitled to use the Customer’s trade mark, logo or name in its external communications.

**Article 11 Provision of services**

11.1 Elvy shall use its best endeavours to perform the services with due care, where applicable in accordance with the agreements and procedures laid down in writing with the Customer. All of Elvy’s services are provided on a best-efforts basis, unless and insofar as Elvy has expressly guaranteed a specific result in the written Agreement and that result has been described with sufficient specificity in the Agreement.

11.2 Elvy shall not be liable for any damage or costs resulting from the use or misuse of access or identification codes, certificates or other security measures, unless such misuse is the direct consequence of wilful misconduct or gross negligence on the part of Elvy’s management.

11.3 If the Agreement has been entered into with a view to performance by a specific individual, Elvy shall at all times be entitled to replace that individual with one or more persons possessing the same and/or similar qualifications.

11.4 Elvy is not obliged to follow the Customer’s instructions when performing its services, in particular where such instructions alter or supplement the content or scope of the agreed services. However, if such instructions are followed, the relevant work shall be remunerated in accordance with Elvy’s standard rates.

**Article 12 Information and other obligations to cooperate**

12.1 The Parties acknowledge that the success of work in the field of information and communication technology depends on proper and timely mutual cooperation. The Customer shall at all times provide all reasonable cooperation in a timely manner.

12.2 The Customer guarantees the accuracy and completeness of the data, information, designs and specifications provided to Elvy by or on behalf of the Customer. If the data, information, designs or specifications provided by the Customer contain inaccuracies of which Elvy is aware, Elvy shall make enquiries with the Customer in this regard.

12.3 To ensure continuity, the Customer shall appoint one or more contact persons to act in that capacity for the duration of Elvy’s work. The Customer’s contact persons shall possess the necessary experience, specific subject-matter knowledge and an understanding of the objectives sought by the Customer.

12.4 The Customer bears the risk associated with the selection of the items, goods and/or services to be supplied by Elvy. The Customer shall at all times exercise the utmost care to ensure that the performance requirements are accurate and complete. Dimensions and specifications stated in drawings, illustrations, catalogues, websites, quotations, advertising material, standardisation sheets and the like are not binding on Elvy, unless Elvy has expressly stated otherwise.

12.5 The workspace and facilities shall comply with all statutory requirements. The Customer shall indemnify Elvy against any claims from third parties, including Elvy’s employees, who, in connection with the performance of the Agreement, suffer damage resulting from acts or omissions on the part of the Customer or from unsafe conditions within the Customer’s organisation. The Customer shall make the internal rules, information policies and security regulations applicable within its organisation known to the staff deployed by Elvy before work commences.

12.6 The Customer is responsible for the management – including checking the settings – of the products supplied and/or services provided by Elvy, and for the manner in which the results of those products and services are utilised. The Customer is also responsible for providing instructions to users and for the users’ use of the products and services.

12.7 The Customer shall itself provide the necessary equipment, infrastructure and supporting software, and shall install, configure, parameterise, and, where necessary, adapt and keep up to date the equipment, other software and operating environment used in this context, and ensure the interoperability required by the Customer.

12.8 Upon termination of the Agreement, the Customer must take the Software out of service. If the Customer fails to do so, Elvy shall be entitled to take measures to ensure that the Software or parts thereof become unusable upon termination or suspension of the Agreement.

**Article 13 Time Limits**

13.1 Elvy shall use reasonable endeavours to comply as far as possible with the (delivery) deadlines and/or (completion) dates, whether or not they are final, specified by it or agreed between the parties. Interim (completion) dates specified by Elvy or agreed between the parties shall always be regarded as target dates; they are not binding on Elvy and are always indicative in nature.

13.2 If there is a risk that any deadline will be exceeded, Elvy and the Customer shall consult with one another to discuss the consequences of the delay for the subsequent planning.

13.3 In all cases – including, therefore, where the parties have agreed on a final (delivery) deadline or (completion) date – Elvy shall only be deemed to be in default due to a delay once the Customer has given Elvy written notice of default, in which the Customer sets Elvy a reasonable period to remedy the breach (of the agreed terms) and this reasonable period has expired. The notice of default must contain as complete and detailed a description of the failure as possible, so that Elvy is given the opportunity to respond appropriately.

13.4 If it has been agreed that the performance of the agreed works shall take place in phases, Elvy shall be entitled to postpone the commencement of the works belonging to a particular phase until the Customer has approved the results of the preceding phase in writing.

13.5 Elvy shall not be bound by any deadline (including a final completion date) or delivery period if the parties have agreed to a change to the content or scope of the Agreement (additional work, changes to specifications, etc.) or a change to the approach to the performance of the Agreement, or if the Customer fails to fulfil, or fails to fulfil in a timely manner or in full, its obligations arising from the Agreement. The fact that (the need for) additional work arises during the performance of the Agreement shall never constitute grounds for the Customer to terminate or rescind the Agreement.

**Article 14 Termination and cancellation of the Agreement**

14.1 Each party shall only be entitled to terminate the Agreement on the grounds of an attributable breach of the Agreement if the other party, in all cases, following a written notice of default that is as detailed as possible and setting a reasonable period for remedying the breach, continues to fail, through its own fault, to fulfil material obligations under the Agreement. The Customer’s payment obligations and all obligations to cooperate and/or provide information by the Customer or a third party engaged by the Customer shall in all cases be regarded as material obligations under the Agreement.

14.2 If, at the time of termination, the Customer has already received performance under the Agreement, such performance and the associated payment obligations shall not be subject to reversal, unless the Customer proves that Elvy is in default with regard to the essential part of those services. Amounts invoiced by Elvy prior to termination in connection with what it has already duly performed or supplied in fulfilment of the Agreement, shall remain due and payable in full, subject to the provisions of the preceding sentence, and shall become immediately due and payable upon termination.

14.3 Either party may terminate the Agreement in whole or in part in writing with immediate effect, without notice of default, if the other party – whether or not provisional – is granted a moratorium on payments, if a petition for bankruptcy is filed against the other party, or if the other party’s business is wound up or terminated other than for the purpose of restructuring or a merger of businesses. Elvy shall under no circumstances be obliged to refund any sums already received or to pay compensation as a result of the termination referred to in this paragraph. In the event that the Customer has irrevocably been declared bankrupt, the Customer’s right to use the software, websites and the like, as well as the Customer’s right to access and/or use Elvy’s services, without any notice of termination being required on Elvy’s part.

**Article 15 Elvy’s Liability**

15.1 Elvy’s total liability for attributable breaches of the Agreement or on any other legal basis, expressly including any failure to fulfil a warranty or indemnity obligation agreed with the Customer, shall be limited to compensation for damage as set out in this article.

15.2 Direct damages shall be limited to a maximum of the price stipulated for that Agreement (excluding VAT). If the Agreement is primarily a continuing contract with a term of more than one year, the price stipulated for that Agreement shall be set at the total of the fees (excluding VAT) stipulated for one year. In no event, however, shall Elvy’s total liability for direct loss, on whatever legal basis, exceed €50,000 (fifty thousand euros).

15.3 Liability for damage resulting from death, personal injury or damage to property is limited to €1,250,000 (one million two hundred and fifty thousand euros).

15.4 Indirect loss, consequential loss, loss of profit, lost savings, diminished goodwill, loss due to business interruption, damage resulting from claims by the Customer’s clients, damage relating to the use of goods, materials or third-party software specified by the Customer to Elvy, and damage relating to the engagement of subcontractors specified by the Customer to Elvy are excluded. Elvy’s liability in connection with the corruption, destruction or loss of data or documents is also excluded.

15.5 The exclusions and limitations of Elvy’s liability set out in Articles 15.2 to 15.4 are without prejudice to the other exclusions and limitations of Elvy’s liability set out in these general terms and conditions.

15.6 The exclusions and limitations referred to in Articles 15.2 to 15.5 shall cease to apply if and to the extent that the damage results from wilful misconduct or deliberate recklessness on the part of Elvy’s management.

15.7 Unless performance by Elvy is permanently impossible, Elvy’s liability for an attributable failure to perform an Agreement shall arise only if the Customer gives Elvy immediate written notice of default, setting a reasonable period for the rectification of the breach, and Elvy continues to fail to fulfil its obligations through its own fault even after that period has elapsed. The notice of default must contain as complete and detailed a description of the breach as possible, so that Elvy is given the opportunity to respond appropriately.

15.8 A prerequisite for the entitlement to any compensation is always that the Customer notifies Elvy in writing of the damage as soon as possible after it has arisen. Any claim for damages against Elvy shall lapse by the mere expiry of 24 (twenty-four) months following the date on which the claim arose, unless the Customer has brought legal proceedings for compensation for the damage before the expiry of that period.

15.9 The Customer shall indemnify Elvy against all claims by third parties arising from product liability as a result of a defect in a product or system supplied by the Customer to a third party and which also comprised equipment, Software or other materials, unless and insofar as the Customer proves that the damage was caused by that equipment, Software or other materials.

15.10 The provisions of this clause, as well as all other limitations and exclusions of liability set out in these general terms and conditions, shall also apply for the benefit of all natural and legal persons of whom Elvy and its suppliers make use in the performance of the Agreement.

**Article 16 Force Majeure**

16.1 Neither party shall be obliged to fulfil any obligation, including any statutory and/or agreed warranty obligation, if it is prevented from doing so as a result of force majeure. Force majeure on the part of Elvy shall be understood to include, amongst other things: (i) failure on the part of Elvy’s suppliers, (ii) defects in goods, equipment, software or materials from third parties the use of which by the Customer has been prescribed to Elvy, (iii) government measures, (iv) power cuts, (v) disruption to the internet, data network or telecommunications facilities, (vi) (cyber)crime, (cyber)vandalism, war or terrorism, and (vii) general transport problems.

16.2 If a force majeure event lasts for more than 60 (sixty) days, either party shall be entitled to terminate the Agreement in writing. In such a case, any work already performed under the Agreement shall be settled on a pro rata basis, without the parties owing each other anything further.

**Article 17 Assignment of rights and obligations**

17.1 The Customer shall never sell, transfer or pledge to a third party the rights and obligations it has under an Agreement.

17.2 Elvy is entitled to sell, assign or pledge its claims for payment of fees to a third party.

**Article 18 Governing law and disputes**

18.1 The Agreements between Elvy and the Customer shall be governed by Dutch law. The applicability of the 1980 Vienna Convention on Contracts for the International Sale of Goods is excluded.

18.2 Any disputes arising out of the Agreement concluded between the parties and/or out of any further Agreements resulting therefrom shall be settled exclusively by the competent court in The Hague.

### Chapter 2. Standard clauses for data processing

**Article 19 General**

19.1 The provisions in this chapter shall, in addition to the general provisions of these general terms and conditions, apply where Elvy, in the context of the performance of the Agreement, processes personal data on behalf of the controller(s) as a (sub)processor (data processor) as referred to in the legislation on the protection of personal data. These Standard Clauses for Processing, together with practical arrangements regarding processing set out in a separate annex, constitute a Data Processing Agreement as referred to in Article 28(3) of the General Data Protection Regulation (GDPR).

19.2 Elvy processes the personal data on behalf of the Customer in accordance with the Customer’s written instructions agreed with Elvy.

19.3 The Customer, or its principal, is the data controller within the meaning of the GDPR, has control over the processing of personal data and has determined the purposes and means of processing the personal data.

19.4 Elvy is a data processor within the meaning of the GDPR and therefore has no control over the purpose and means of processing the personal data and consequently does not make decisions regarding, amongst other things, the use of the personal data.

19.5 Elvy complies with the GDPR as set out in this chapter ‘Standard Clauses for Processing’. It is for the Customer to assess, on the basis of this information, whether Elvy offers sufficient guarantees regarding the implementation of appropriate technical and organisational measures, so that the processing complies with the requirements of the GDPR and the protection of data subjects’ rights is adequately safeguarded.

19.6 The Customer warrants to Elvy that it acts in accordance with the GDPR, that it adequately secures its systems and infrastructure at all times, and that the content, use and/or processing of personal data is not unlawful and does not infringe any rights of a third party.

19.7 The Customer is not entitled to recover from Elvy any administrative fine imposed on it by the supervisory authority on any legal basis whatsoever. In this chapter, ‘supervisory authority’ refers to a supervisory authority as defined in the GDPR.

19.8 Article 28(1) of the GDPR requires that a contract be concluded between the data controller and the data processor, setting out the processing of personal data by the data processor on behalf of the data controller. This agreement is set out in the Data Processor Agreement, which forms an integral part of these General Terms and Conditions and, consequently, of the other agreements.

**Article 20 Security**

20.1 Elvy shall implement the technical and organisational security measures as described in these General Terms and Conditions. In implementing the technical and organisational security measures, Elvy has taken into account the state of the art, the costs of implementing the security measures, the nature, scope and context of the processing, the nature of its products and services, the processing risks, and the risks to the rights and freedoms of data subjects—which vary in terms of likelihood and severity—that Elvy could reasonably expect given the intended use of its products and services.

20.2 Unless explicitly stated otherwise in the agreement, Elvy’s product or service is not designed for the processing of special categories of personal data or data relating to criminal convictions or offences.

20.3 Elvy endeavours to ensure that the security measures it implements are appropriate for the intended use of the product or service by Elvy.

20.4 In the Customer’s opinion, taking into account the factors referred to in clause 20.1, the security measures described provide a level of security commensurate with the risk associated with the processing of the personal data used or provided by the Customer.

20.5 Elvy may make changes to the security measures in place if, in its opinion, this is necessary to continue to provide an appropriate level of security. Elvy shall document any significant changes and shall notify the Customer of such changes where relevant.

20.6 The Customer may request Elvy to implement further security measures. Elvy is under no obligation to implement changes to its security measures in response to such a request. Elvy may charge the Customer for the costs associated with changes implemented at the Customer’s request. Only once the amended security measures requested by the Customer have been agreed in writing by the parties shall Elvy be obliged to actually implement these security measures.

**Article 21 Personal data breaches**

21.1 Elvy does not guarantee that the security measures will be effective under all circumstances. If Elvy discovers a personal data breach, it shall inform the Customer without undue delay. The Agreement sets out the manner in which Elvy shall inform the Customer of personal data breaches. If no specific arrangements have been made, Elvy shall contact the Customer’s designated contact person in the usual manner.

21.2 It is the responsibility of the data controller (the Customer, or its principal) to assess whether the personal data breach of which Elvy has informed them must be reported to the supervisory authority or the data subject. The reporting of personal data breaches remains at all times the responsibility of the data controller (the Customer or its principal). Elvy is under no obligation to report personal data breaches to the supervisory authority and/or the data subjects.

21.3 Elvy shall, where necessary, provide further information regarding the personal data breach and shall cooperate in providing the Customer with the information required for the purpose of reporting the breach to the supervisory authority or the data subjects.

21.4 Elvy may charge the Customer for any reasonable costs incurred in this regard at its then-current rates.

**Article 22 Confidentiality**

22.1 Elvy guarantees that the persons processing personal data under its responsibility are bound by a duty of confidentiality.

22.2 Elvy is entitled to disclose personal data to third parties if and insofar as such disclosure is necessary pursuant to a court ruling, a statutory provision, on the basis of a valid order issued by a public authority, or for the proper performance of the agreement.

**Article 23 Obligations upon termination**

23.1 In the event of the termination of the Agreement, Elvy shall, within a reasonable period, delete all personal data in its possession and received from the Customer in such a way that it can no longer be used and is no longer accessible, or, if agreed, return it to the Customer in a machine-readable format.

23.2 Elvy may charge the Customer for any costs it incurs in connection with the provisions of the previous paragraph. Further arrangements in this regard may be set out in the Agreement.

23.3 The provisions of clause 23.1 shall not apply if a statutory provision prevents Elvy from deleting or returning the personal data, either in whole or in part. In such a case, Elvy shall continue to process the personal data only to the extent necessary to fulfil its legal obligations. The provisions of clause 23.1 shall also not apply if Elvy is the data controller within the meaning of the GDPR with regard to the personal data.

**Article 24 Rights of data subjects, Data Protection Impact Assessment (DPIA) and audit rights**

24.1 Elvy shall, where possible, cooperate with reasonable requests from the Customer relating to rights of data subjects invoked by data subjects with the Customer. If Elvy is contacted directly by a data subject, it shall, where possible, refer them to the Customer.

24.2 Where the Customer is obliged to do so under the GDPR, Elvy shall, following a reasonable request to that effect, cooperate with a data protection impact assessment (DPIA) or any subsequent prior consultation.

24.3 At the Customer’s request, Elvy shall make available all information reasonably necessary to demonstrate compliance with the agreements set out in the Agreement regarding the processing of personal data, for example by means of a valid Data Pro Certificate or a certificate at least equivalent to it, an audit report (Third Party Memorandum) drawn up by an independent expert commissioned by Elvy, or by means of other information to be provided by Elvy. If, despite this, the Customer has reason to believe that the processing of personal data is not taking place in accordance with the Agreement, it may, no more than once a year, have an audit carried out by an independent, certified, external expert, who has demonstrable experience with the type of processing carried out under the agreement, at the Customer’s expense. Elvy shall be entitled to refuse an expert if, in Elvy’s view, the expert would undermine its competitive position. The audit shall be limited to verifying compliance with the agreements relating to the processing of personal data as set out in the agreement. The expert shall be bound by a duty of confidentiality regarding the findings of the audit and shall report to the Customer only those matters that constitute a failure to fulfil Elvy’s obligations under the Agreement. The expert shall provide Elvy with a copy of their report. Elvy may refuse to accept an expert, an audit or instructions from the expert if, in its opinion, these contravene the GDPR or other legislation, or constitute an impermissible breach of the security measures it has put in place.

24.4 The Parties shall consult as soon as possible regarding the findings set out in the report. The Parties shall implement the proposed improvement measures set out in the report to the extent that this can reasonably be expected of them. Elvy shall implement the proposed improvement measures to the extent that it deems them appropriate, taking into account the processing risks associated with its product or service, the state of the art, the implementation costs, the market in which it operates and the intended use of the product or service.

24.5 Elvy is entitled to charge the Customer for the costs it incurs in connection with the provisions of this Article.

**Article 25 Sub-processors**

25.1 The Customer authorises Elvy to engage other sub-processors to fulfil its obligations arising from the Agreement.

25.2 Elvy shall inform the Customer of any change to the third parties engaged by Elvy. The Customer has the right to object to such a change by Elvy.